⬢ DragonFlyBSD Kernel Audit
DF-3986 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-3986",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "cayman_init (ni.c:2434-2443) initializes only GFX/DMA0/DMA1 rings; the CP1/CP2 compute-ring r600_ring_init blocks present in upstream Linux ni.c (and mirrored in-tree by si.c:6876-6894 and cik.c:8655-8679) were dropped in the port. Consumers remained: cayman_cp_resume (ni.c:1636-1734) computes order_base_2(ring->ring_size/8) for CP1/CP2 with ring_size==0 (ni.c:1704), which expands to ilog2(roundup_pow_of_two(0)) = 1UL<<flsl(ULONG_MAX) = 1UL<<64 - undefined shift per C11 6.5.7 (log2.h:33-36,100) - and programs CP_RB1/CP_RB2 with RB_BUFSZ derived from it and base 0 (ni.c:1713-1721) on every Cayman/Aruba boot; fence start for CP1/CP2 still runs (ni.c:2225,2231). No kernel memory-safety impact: radeon_cs_get_ring maps COMPUTE to CP1/CP2 only for family >= CHIP_TAHITI (radeon_cs.c:218-224), and radeon_ring_alloc rejects ndw > ring_size/4 (radeon_ring.c:109-111). Info-severity porting divergence + boot-path UB; hardware-gated (guest has no AMD GPU - vgapci is QEMU 1234:1111, ../DF-3981/env.txt) so no runtime verification possible.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (divergence proof, UB expansion, no-impact argument); fix.diff (restores the two upstream init blocks verbatim, patch --dry-run clean)",
  "kernel_refs": [
    "sys/dev/drm/radeon/ni.c:2434",
    "sys/dev/drm/radeon/ni.c:1704",
    "sys/dev/drm/radeon/ni.c:1713",
    "sys/dev/drm/radeon/ni.c:2225",
    "sys/dev/drm/radeon/si.c:6876",
    "sys/dev/drm/radeon/cik.c:8655",
    "sys/dev/drm/include/linux/log2.h:33",
    "sys/dev/drm/radeon/radeon_cs.c:218",
    "sys/dev/drm/radeon/radeon_ring.c:109"
  ],
  "poc_changes": "None possible: no AMD GPU on the guest; the finding is a provable source divergence.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Orchestrator hint functions ni_vram_gddr5/ni_mc_program/ni_set_uvd_clocks/dce6 watermark do not exist in this tree (verified by rg over sys/dev/drm/radeon/) - those live in ni_dpm.c/evergreen.c/dce6_afmt.c outside this files scope; ni.c itself is cayman_* init/resume plumbing.",
  "recommended_fix": "Restore the two dropped r600_ring_init blocks for CAYMAN_RING_TYPE_CP1/CP2_INDEX in cayman_init (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applies cleanly against sys/dev/drm/radeon/ni.c; cannot be kernel-build/boot validated without NI hardware.",
  "fix_evidence": "fix.diff in pack; upstream-shape init blocks"
}