⬢ DragonFlyBSD Kernel Audit
DF-3993 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3993",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Source-certain NULL-deref kernel panic, hardware-gated: radeon_cs_parser_init() dereferences asic->ring[p->ring] (radeon_cs.c:376/381) where p->ring comes from the user FLAGS chunk via radeon_cs_get_ring() (radeon_cs.c:236-242) with no family gating, while the per-family dispatch tables in radeon_asic.c (r100..r600: ring[R600_RING_TYPE_UVD_INDEX]=NULL, all families except TN/SI/CI/KV: ring[TN_RING_TYPE_VCE1_INDEX]=NULL) leave those slots NULL. cs_parse sits at offset 0x20 of struct radeon_asic_ring -> kernel read at 0x20 -> fatal page fault before any GEM/IB validation, reachable by an unprivileged local user through DRM_IOCTL_RADEON_CS (DRM_AUTH|DRM_RENDER_ALLOW, radeon_kms.c:912), the same surface as DF-3763/DF-3953. Cannot be reproduced on the audit guest: no /dev/dri, no DRM kmod, and QEMU has no radeon device model at all (env.txt); trigger compiles clean on the guest toolchain (build.log) and exits reporting the absent device.",
  "exploit_chain": "",
  "evidence": "README.md (crash matrix + table citations), VERDICT.md (line-by-line trace), cs_nullring.c (working trigger for real hw: single FLAGS chunk {0, RADEON_CS_RING_UVD}), build.log (guest toolchain BUILD OK + absent /dev/dri), env.txt (no radeon device), fix.diff (family gates + NULL-slot guard)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_asic.c:214",
    "sys/dev/drm/radeon/radeon_asic.c:950",
    "sys/dev/drm/radeon/radeon_asic.c:1686",
    "sys/dev/drm/radeon/radeon_cs.c:357",
    "sys/dev/drm/radeon/radeon_cs.c:236",
    "sys/dev/drm/radeon/radeon_cs.c:376",
    "sys/dev/drm/radeon/radeon.h:1821",
    "sys/dev/drm/radeon/radeon_kms.c:912"
  ],
  "poc_changes": "n/a (seed authored during this run; layout verified against sys/dev/drm/include/uapi/drm/radeon_drm.h:950-991)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o cs_nullring cs_nullring.c",
  "run_cmd": "./cs_nullring 3   # on radeon hw: kernel panic at radeon_cs.c:376",
  "code_hash": "7afd983fdb0f4627137c50a8b98aed2af282885ff34a235f4b2513cef1ee3a71",
  "notes": "Hardware-gated (same class as DF-3763/DF-3953, both accepted as inconclusive/panic). HAINAN secondary path (table wires UVD ring while has_uvd=false) fails safely later at radeon_ib_schedule()s ring->ready check (radeon_ib.c:128), so the NULL-slot deref is the only panic on this surface.",
  "recommended_fix": "Gate UVD/VCE ring ids by family in radeon_cs_get_ring() and check asic->ring[p->ring] != NULL before the ->cs_parse/->ib_parse deref in radeon_cs_parser_init()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the family gates and a NULL-slot guard (radeon_cs.c); not buildable/testable here because the guest has no radeon hardware or DRM kmod to build the module against \u2014 kernel-build validation requires a radeon-equipped target.",
  "fix_evidence": "findings/poc/DF-3993/fix.diff (unified diff, never applied to sys/)"
}