⬢ DragonFlyBSD Kernel Audit
DF-3969 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3969",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain missing NULL checks: rt2560_scan_end (rt2560.c:2566-2574) dereferences ic->ic_scan->ss_vap->iv_bss and rt2560_enable_tsf_sync (rt2560.c:2277,2284) dereferences TAILQ_FIRST(&ic->ic_vaps)->iv_bss without checking for NULL; the scanner invokes ic_scan_end unlocked (ieee80211_scan_sw.c:796-798, self-annotated scan state can change!) and ieee80211_scan_vdetach (ieee80211_scan.c:147-155) clears ss_vap and empties ic_vaps under the lock \u2014 destroying the only vap in that window yields NULL -> Fatal trap 12 (privileged-triggered race, local DoS). Identical pattern to the proven sibling finding DF-3968 (rt2661); rt2560 even guards the same TAILQ_FIRST elsewhere (rt2560.c:2691). Not reproduced: the audit guest has no Ralink NIC (env.txt); the on-target trigger recipe (destroy-vs-bgscan loop) is documented in trigger.c.",
  "exploit_chain": "assoc + background scan running -> concurrent ifconfig wlan0 destroy wins the unlocked ic_scan_end window -> ieee80211_vap_delete/scan_vdetach clears ss_vap and empties ic_vaps -> rt2560_enable_tsf_sync reads vap->iv_bss at NULL (2284) or rt2560_scan_end reads ss_vap->iv_bss (2573) -> kernel panic (DoS).",
  "evidence": "VERDICT.md (race window path:line incl. net80211 call site and the guarded sibling line rt2560.c:2691), trigger.c (on-target loop), env.txt (no Ralink NIC), fix.diff (NULL guards at both sites), build.log (if_ral.ko rebuilt -Werror clean on the guest /usr/src copy)",
  "kernel_refs": [
    "sys/dev/netif/ral/rt2560.c:2566",
    "sys/dev/netif/ral/rt2560.c:2571",
    "sys/dev/netif/ral/rt2560.c:2573",
    "sys/dev/netif/ral/rt2560.c:2277",
    "sys/dev/netif/ral/rt2560.c:2284",
    "sys/dev/netif/ral/rt2560.c:2691",
    "sys/netproto/802_11/wlan/ieee80211_scan_sw.c:796",
    "sys/netproto/802_11/wlan/ieee80211_scan.c:147"
  ],
  "poc_changes": "Trigger is a documented race recipe (needs NIC + association); informational C stub compiled only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /usr/src && patch -p1 < /root/fix1.diff && cd sys/dev/netif/ral && make   # -Werror, full if_ral.ko link (build.log)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -lv | grep -i ralink; ifconfig -l   # => no Ralink device (run.log/env.txt)",
  "code_hash": "d1ec4747b40848f34e360e892f99a12591e3e4426b417306d2df93d02fe0da5e",
  "notes": "Pass-2 finding (GLM 5.3). FreeBSD-inherited pattern, sibling of DF-3968 (rt2661). DoS-only (privileged destroy race); no memory corruption.",
  "recommended_fix": "NULL-guard ss_vap in rt2560_scan_end and TAILQ_FIRST in rt2560_enable_tsf_sync (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Two two-line NULL guards eliminate the deref; git apply --check clean against sys/ and the patched module rebuilt -Werror clean (build.log; combined with the other two rt2560 fix.diffs of this batch). Runtime validation impossible without the NIC.",
  "fix_evidence": "fix.diff; build.log (if_ral.ko linked from patched rt2560.o with -Werror on the guest /usr/src copy)"
}