⬢ DragonFlyBSD Kernel Audit
DF-3943 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3943",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain error-path imbalance: resource_build_scaling_params() doubles the shared dc_stream_state.dst.height for INTERLACE at entry (dc_resource.c:1118-1119) but the early return false for viewport<16 (:1125-1126) skips the compensating /=2 (:1188-1189), so every failed interlaced validation permanently doubles the persistent streams dst.height; compounding across attempts overflows the signed int (~21 doublings from 1080). Guest has no AMD GPU (no /dev/dri, virtio-gpu), so not reproduced at kernel level; a verbatim userland transcription of the control flow run on the guest (run.log) shows 1080->2160->...->-2030043136. Upstream dropped the shared-state mutation entirely by Linux v5.4.",
  "exploit_chain": "",
  "evidence": "run.log (interlace_sim: compounding doubling + signed wrap at attempt 21), interlace_sim.c (verbatim control flow of :1118-1189), VERDICT.md (root cause + upstream v5.4 comparison), fix.diff (git-apply-clean)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:1118",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:1125",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:1188",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:637",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:1204"
  ],
  "poc_changes": "no seed; harness transcribed verbatim from the kernel function",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/interlace_sim interlace_sim.c",
  "run_cmd": "/tmp/interlace_sim",
  "code_hash": "3a9ef11740c6ed00c80de0196fdd9f0cc711031f9fef301371f1d65280db7c57",
  "notes": "hardware-gated (amdgpu DC + interlaced mode + DRM master); not re-reporting DF-1301 zero-rect divisions (separate class, known)",
  "recommended_fix": "Restore dst.height /= 2 on the early-return path, or stop mutating the shared stream in validation (upstream v5.4 removed the pattern)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "cannot build/run amdgpu DC on the audit guest (no AMD GPU); fix.diff applies clean to sys/ and restores the *=2//=/=2 balance",
  "fix_evidence": "fix.diff; git apply --check clean"
}