⬢ DragonFlyBSD Kernel Audit
DF-3956 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3956",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain u32-underflow wild read, amdgpu twin DF-3890 (Low). sumo_construct_vid_mapping_table (sumo_dpm.c:1616-1645, producer - its usVoltageIndex OOB write is already DF-1437, NOT re-reported) leaves vid_mapping_table.num_entries==0 when sAvail_SCLK has no nonzero ulSupportedSCLK, and kv_parse_sys_info_table (kv_dpm.c:2495-2546) also succeeds with an all-zero table when IntegratedSystemInfo is missing entirely. With vddc_dependency_on_sclk.count==0 (KB/ML) the else-branch of kv_convert_vid2_to_vid7 (:566) / kv_convert_vid7_to_vid2 (:590) evaluates entries[num_entries - 1] with u32 num_entries (sumo_dpm.h:65): index 0xFFFFFFFF * sizeof(entry)=4 = +0x3FFFFFFFC (~16 GiB) past the kv_power_info heap object -> kernel page fault -> panic. Boot path: kv_dpm_enable -> kv_init_graphics_levels else-branch (:2382->kv_set_vid:618 / :2378) and kv_parse_sys_info_table -> kv_construct_max_power_limits_table (:2543->:1973). Harness: producer replay yields num_entries=0; verbatim consumer expression faults SIGSEGV against a guard page; displacement print 0x3fffffffc (16.00 GiB). Runtime-inconclusive: no AMD GPU on guest.",
  "exploit_chain": "KV/KB/ML APU with VBIOS lacking the sclk dependency table AND an empty/missing IntegratedSystemInfo vid mapping -> boot-time kv_init_graphics_levels -> kv_convert_vid2_to_vid7 -> wild read ~16 GiB out -> page fault -> panic (DoS). Load-only 16-bit value feeding voltage math; no write, no leak channel.",
  "evidence": "run.log: producer: sumo_construct_vid_mapping_table -> num_entries = 0, consumer: kv_convert_vid2_to_vid7 :566 -> entries[0xffffffff] -> +0x3fffffffc (16.00 GiB), child: SIGNALLED sig=11, RESULT: WILD READ FAULTS AS PREDICTED; VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/kv_dpm.c:566",
    "sys/dev/drm/radeon/kv_dpm.c:590",
    "sys/dev/drm/radeon/kv_dpm.c:604",
    "sys/dev/drm/radeon/kv_dpm.c:2382",
    "sys/dev/drm/radeon/kv_dpm.c:2495",
    "sys/dev/drm/radeon/sumo_dpm.c:1616",
    "sys/dev/drm/radeon/sumo_dpm.h:65"
  ],
  "poc_changes": "No seed (pass-2 self-authored). Two fix cycles: missing <signal.h>; and the analysis print initially used 64-bit unsigned math instead of the kernels u32 index semantics (corrected to 0xffffffff*4 = 0x3fffffffc).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 110,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/df395x && cc -O2 -Wall -o trigger_df3956 trigger_df3956.c",
  "run_cmd": "cd /tmp/df395x && ./trigger_df3956 && ./trigger_df3956 crash",
  "code_hash": "d6de195aa66112c81a94572f4a2ebdadaa960d74b1df3e53352f8bd9e3915e29",
  "notes": "Distinct from pass-1 DF-1305/1306/1307 and from DF-1437/DF-1439 (sumo_dpm.c file-local siblings). kv_parse_sys_info_tables missing-table-returns-success behavior is itself noteworthy hardening (it gates this bug and leaves bootup_sclk=0).",
  "recommended_fix": "num_entries==0 early-outs returning 0 in kv_convert_vid2_to_vid7 and kv_convert_vid7_to_vid2 (fix.diff); ideally also treat a missing IntegratedSystemInfo table as an error in kv_parse_sys_info_table.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree; not built - no AMD hardware on the guest. Guards remove both sinks by construction.",
  "fix_evidence": "findings/poc/DF-3956/fix.diff"
}