⬢ DragonFlyBSD Kernel Audit
DF-3940 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3940",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on the guest: requires an AMD Sea Islands GPU + crafted VBIOS (no 0x1002 function on the guest, env.txt). fix.diff clamps the MCLK count to SMU7_MAX_LEVELS_MEMORY at the ci_smumgr.c sinks (populate loop, MemoryDpmLevelCount, [count-1] store, mc_regs->data[] loop) and is authored post-verification against the cited lines; min_t is already used in this TU (ci_smumgr.c:391).",
  "fix_evidence": "findings/poc/DF-3940/fix.diff + VERDICT.md",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "CI twin of DF-3909: the VBIOS-derived mclk DPM count (up to MAX_REGULAR_DPM_NUMBER=8, unclamped from processpptables.c:391 ucNumEntries through smu7_hwmgr.c:704-710 dpm_levels[8]; the MCLK family is the only one without an upstream trim - voltages are trimmed at smu7_hwmgr.c:324-346, PCIE capped at :557-569) is used to index arrays dimensioned SMU7_MAX_LEVELS_MEMORY=6 for CI (ci_smumgr.h:27): MemoryLevel[i] full ~40B structs at ci_smumgr.c:1314-1318, the unguarded MemoryLevel[count-1] store at :1339, SMU7_Discrete_MCRegisterSet (16x u32 VBIOS MC data) into mc_regs->data[i] at :1794-1798 (SET_COUNT=6, smu7_discrete.h:408), and the runtime mclk_levels[MemoryDpmLevelCount] writes at :2819-2846. All land in the kzallocd struct ci_smumgr (ci_smumgr.c:2731-2743): sinks 1-2 clobber LinkLevel[0..2], sink 3 clobbers the trailing ci_mc_reg_table - in-object heap corruption with VBIOS-chosen contents, then byte-copied into SMC. Crafted-VBIOS vector on Bonaire/Hawaii; hardware absent from the audit guest => inconclusive, source-certain, like tonga DF-3909.",
  "exploit_chain": "craft VBIOS with vdd_dep_on_mclk = 7-8 distinct MCLK entries -> amdgpu DPM enable -> ci_init_smc_table -> ci_populate_all_memory_levels/ci_populate_initial_mc_reg_table write past MemoryLevel[6]/mc_regs.data[6] -> corrupt LinkLevel + ci_mc_reg_table in the ci_smumgr heap object -> confused SMC state / OOD writes on every profile update (ci_update_dpm_settings)",
  "evidence": "findings/poc/DF-3940/VERDICT.md (sink table + provenance), fix.diff, env.txt",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1314",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1339",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1794",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:2819",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:2731",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.h:27",
    "sys/dev/drm/amd/powerplay/inc/smu7_discrete.h:325",
    "sys/dev/drm/amd/powerplay/inc/smu7_discrete.h:408",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:704",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:391"
  ],
  "poc_changes": "No seed PoC; hardware-gated (AMD CI GPU + crafted VBIOS).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3, bucket memcorrupt. Same unclamped-count root cause as DF-3939; shared root fix = trim MCLK count in smu7_setup_dpm_tables_v0/v1 like the voltage/PCIE tables. Negative results recorded in VERDICT.md: voltage-level tables (VddcLevel/VddciLevel/MvddLevel) are trimmed upstream (smu7_hwmgr.c:324-346) and the LinkLevel i <= count loop at ci_smumgr.c:1003 is unreachable-OOB because PCIE count is capped at 7 (smu7_hwmgr.c:557-569).",
  "recommended_fix": "Clamp mclk count to SMU7_MAX_LEVELS_MEMORY at the ci_smumgr.c sinks (fix.diff), or trim MCLK levels once in smu7_setup_dpm_tables_v0/v1.",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}