⬢ DragonFlyBSD Kernel Audit
DF-3939 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3939",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: the trigger requires an AMD Sea Islands GPU plus a crafted VBIOS; the audit guest has no 0x1002 PCI function at all (env.txt). fix.diff is a pure bounds clamp (SMU7_MAX_LEVELS_GRAPHICS/SMU7_MAX_LEVELS_MEMORY) authored post-verification against ci_smumgr.c:1658-1663.",
  "fix_evidence": "findings/poc/DF-3939/fix.diff + VERDICT.md",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CI twin of DF-3908: ci_program_memory_timing_parameters declares a 576-byte STACK object SMU7_Discrete_MCArbDramTimingTable whose entries[] is [8][6] for CI (ci_smumgr.h:26-27; smu7_discrete.h:233-236, entry=12B) but drives it with the raw VBIOS-derived DPM counts (ci_smumgr.c:1658-1663). MCLK counts up to MAX_REGULAR_DPM_NUMBER=8 flow unclamped from the pptable parser (processpptables.c:391 ucNumEntries -> dynamically-sized table) through smu7_setup_dpm_tables_v0 (smu7_hwmgr.c:704-710, dedup into dpm_levels[8]; unlike the VDDC/VDDCI/MVDD trims at smu7_hwmgr.c:324-346 and the PCIE cap at :557-569, MCLK is never trimmed to the SMC tables 6). mclk count 7-8 => j=6,7: rows i<7 alias entries[i+1][0..1] (wrong-cell corruption); with sclk count 8, row i=7 writes offsets 576..599, i.e. up to 24 bytes PAST the stack object, with McArbDramTiming/McArbDramTiming2 values the VBIOS computes from attacker-chosen clocks (ci_populate_memory_timing_parameters :1619-1645). Reachable at DPM init (ci_init_smc_table :2002) and OD update (:2239). Hardware-gated (no AMD GPU in guest, env.txt) => inconclusive, source-certain, exactly like tonga DF-3908.",
  "exploit_chain": "craft VBIOS with vdd_dep_on_mclk count>=7 (distinct) + vdd_dep_on_sclk count 8 -> amdgpu DPM enable -> ci_init_smc_table -> ci_program_memory_timing_parameters -> 24B semi-controlled write past 576B stack object (repeatable per DPM table update) -> stack corruption / panic; on non-hardened kernels a stack-pivot candidate",
  "evidence": "findings/poc/DF-3939/VERDICT.md (offset math table), fix.diff, env.txt (no 0x1002 device)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1653",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1658",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1663",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:2002",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.h:27",
    "sys/dev/drm/amd/powerplay/inc/smu7_discrete.h:233",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:704",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.h:95",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:391"
  ],
  "poc_changes": "No seed PoC; hardware-gated (AMD CI GPU + crafted VBIOS required, absent from guest).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3, Dillon bucket memcorrupt. Same root cause feeds DF-3940 (heap sinks); the shared root fix is trimming mclk/sclk counts in smu7_setup_dpm_tables like the voltage/PCIE tables. NOTE for orchestrator: dep-table counts >8 separately overflow dpm_levels[8] inside smu7_hwmgr.c:704-710/783-799 (different file, not re-reported here).",
  "recommended_fix": "Clamp the ARB loops to SMU7_MAX_LEVELS_GRAPHICS/SMU7_MAX_LEVELS_MEMORY (or trim MCLK count once in smu7_setup_dpm_tables_v0/v1).",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}