⬢ DragonFlyBSD Kernel Audit
DF-3975 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-3975",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "btc_dpm_get_sclk/btc_dpm_get_mclk (btc_dpm.c:2802-2822) unconditionally dereference eg_pi->requested_rps.ps_priv, which stays NULL from the eg_pi kzalloc (btc_dpm.c:2556) until the first btc_dpm_pre_set_power_state (2293); radeon_dpm_change_power_state_lockeds early returns (radeon_pm.c:1080,1105-1107) can defer that first call indefinitely on headless/single-state systems, while evergreen watermark code calls radeon_dpm_get_sclk directly from display commit (evergreen.c:2162-2197 via atombios_crtc.c:1448/1642) whenever dpm_enabled. First display event in the window \u2192 NULL-page read \u2192 panic. Structural twin of DF-3953s ps_priv window for the btc asic ops; hardware-gated (no radeon GPU in guest) so inconclusive with source-level likelihood.",
  "exploit_chain": "",
  "evidence": "VERDICT.md boot\u2192hotplug trace; the ioctl path (radeon_kms.c:567-580) uses get_current_sclk and is safe \u2014 the vulnerable consumer is the display-bandwidth path",
  "kernel_refs": [
    "sys/dev/drm/radeon/btc_dpm.c:2802",
    "sys/dev/drm/radeon/btc_dpm.c:2813",
    "sys/dev/drm/radeon/btc_dpm.c:2266",
    "sys/dev/drm/radeon/btc_dpm.c:2293",
    "sys/dev/drm/radeon/btc_dpm.c:2485",
    "sys/dev/drm/radeon/btc_dpm.c:2556",
    "sys/dev/drm/radeon/evergreen.c:2162",
    "sys/dev/drm/radeon/atombios_crtc.c:1448",
    "sys/dev/drm/radeon/radeon_pm.c:1080",
    "sys/dev/drm/radeon/radeon_pm.c:1449"
  ],
  "poc_changes": "No PoC: hardware-gated (needs real Barts-class display pipeline to order the events).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Physical-action trigger (display hotplug) on default-enabled DPM; Medium consistent with DF-3953/DF-3754.",
  "recommended_fix": "Prime requested_rps from boot_ps at the end of btc_dpm_enable (btc_update_requested_ps at 2485) so get_sclk/get_mclk never observe ps_priv==NULL.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": null,
  "fix_patched_reproduced": null,
  "fix_verdict": "fix.diff authored (prime requested_rps at enable); not build-testable without the hardware.",
  "fix_evidence": "findings/poc/DF-3975/fix.diff"
}