⬢ DragonFlyBSD Kernel Audit
DF-3968 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3968",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain missing NULL checks: rt2661_scan_end (rt2661.c:2843-2847) dereferences vap->iv_bss and rt2661_enable_tsf_sync (rt2661.c:2747-2750) dereferences vap->iv_opmode on TAILQ_FIRST(&ic->ic_vaps) without checking for an empty list; the scanner invokes ic_scan_end unlocked (ieee80211_scan_sw.c:797, self-annotated scan state can change!), and ieee80211_scan_vdetach (ieee80211_scan.c:140-155) removes the last vap under the lock \u2014 destroying the only vap in that window yields vap==NULL -> Fatal trap 12 (privileged-triggered race, local DoS). Not reproduced: guest has no Ralink NIC (env.txt); trigger recipe (destroy-vs-bgscan loop) documented in trigger.c.",
  "exploit_chain": "assoc + background scan running -> concurrent ifconfig wlan0 destroy wins the unlocked ic_scan_end window -> ieee80211_vap_delete/scan_vdetach empties ic_vaps -> rt2661_scan_end reads vap->iv_bss at NULL -> kernel panic (DoS).",
  "evidence": "VERDICT.md (race window path:line incl. net80211 call site), trigger.c (on-target loop), env.txt, fix.diff (NULL guards at both sites, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/netif/ral/rt2661.c:2843",
    "sys/dev/netif/ral/rt2661.c:2847",
    "sys/dev/netif/ral/rt2661.c:2747",
    "sys/dev/netif/ral/rt2661.c:2750",
    "sys/netproto/802_11/wlan/ieee80211_scan_sw.c:797",
    "sys/netproto/802_11/wlan/ieee80211_scan.c:147"
  ],
  "poc_changes": "Trigger is a documented race recipe (needs NIC + association); informational C stub compiled only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 4,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /usr/src/sys/dev/netif/ral && patch -p1 < fix.diff && make   # after make obj",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -lv | grep -i ralink; ifconfig -l",
  "code_hash": "21c3d2524ded654870f1c35cfab6b4693f8becb3f3e794c456e86f07def93463",
  "notes": "Pass-2 finding. FreeBSD-inherited pattern. DoS-only (privileged destroy race); no memory corruption.",
  "recommended_fix": "NULL-guard TAILQ_FIRST(&ic->ic_vaps) in rt2661_scan_end and rt2661_enable_tsf_sync (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Two two-line guards eliminate the NULL deref; git apply --check clean. Runtime validation needs the NIC fix.diff applied to the guest /usr/src copy and the if_ral.ko module rebuilt clean with -Werror (build.log; combined with the other two rt2661 fix.diffs of this batch); runtime validation still impossible without the NIC.",
  "fix_evidence": "fix.diff; fix.diff applied to the guest /usr/src copy and the if_ral.ko module rebuilt clean with -Werror (build.log; combined with the other two rt2661 fix.diffs of this batch); runtime validation still impossible without the NIC."
}