⬢ DragonFlyBSD Kernel Audit
DF-4000 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
{
  "finding_id": "DF-4000",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel heap + stack OOB writes: the iceland (Topaz) SMC-table populate walks index GraphicsLevel[8], MemoryLevel[4], the 384-byte STACK MCArbDramTimingTable (entries[8][4]) and mc_regs.data[4] with the raw VBIOS SCLK/MCLK dependency-table counts (u8 ucNumEntries, unclamped through processpptables.c:391 -> smu7_hwmgr.c:689-711 -> dpm_table, Topaz pinned to this path at hwmgr.c:114-122). Icelands bounds are tighter than the CI/tonga siblings: mclk count 5 (vs 7 for CI) already smashes MemoryLevel[4] and the stack arb table. Guest demonstrator with verbatim struct replicas reproduces the exact index math (sclk=12/mclk=6: 4/12 GraphicsLevel writes +192B, 2/6 MemoryLevel writes +144B, 26/72 stack writes +216B past the 384B object, 2/6 mc_regs.data writes); the in-kernel fault could not be observed - no AMD GPU in QEMU and the trigger requires a Topaz card with a crafted VBIOS (physical attacker / malicious vBIOS). Hardware-gated, matching the DF-3908/3939/3940 precedent. Fix compile-validated by full nativekernel rebuild (error_count=0, iceland_smumgr.c under -Werror).",
  "exploit_chain": "",
  "evidence": "run.log (demonstrator output on guest: 26/72 stack writes OOB, max linear entry 49 of 32, +216B past the 384-byte stack object; heap arrays +192B/+144B); VERDICT.md full three-hop provenance + killed-candidates list; fix_build.log (patch-OK + started/completed + error_count=0); fix_kernel_full.log:11214 (iceland_smumgr.c compile line, -Werror); env.txt (amd-gpu=0)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:980",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:997",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1026",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1361",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1385",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1616",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1621",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1761",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:1796",
    "sys/dev/drm/amd/powerplay/inc/smu71.h:32",
    "sys/dev/drm/amd/powerplay/inc/smu71_discrete.h:179",
    "sys/dev/drm/amd/powerplay/inc/smu71_discrete.h:270",
    "sys/dev/drm/amd/powerplay/inc/smu71_discrete.h:370",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:689",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:391",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:114"
  ],
  "poc_changes": "Pass-2 reviewer authored demonstrator (verbatim struct replicas from smu71_discrete.h so sizeof/offsets are the kernels own) + fix.diff generated mechanically against the pristine file (8 hunks); fix compile-validated via full nativekernel rebuild on the guest.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 2100,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "721ac74b1e67ba947c5e2246694cf298328885ec158ce5042e060db816e1a2ef",
  "notes": "Hardware-gated (env.txt: amd-gpu=0). Checklist outcomes: (a) this finding; (b) firmware size/alignment checks present (iceland_smumgr.c:195-203,163); (c) no AVFS code in this file; (d) iceland_get_dependency_volt_by_clk safe (count==0 checked, :513); populate_mvdd_value cross-index latent-but-unreachable (only caller passes mclk=0 -> always i=0); (e) Topaz pinned PP_TABLE_V0+SMU71 consistently, no version-confusion path. Killed: LinkLevel i<=count off-by-one (pcie count<=7 by boot-level reservation), BAPMTI walk exact-fit 15==15, mc special-register j-asserts, fan div0 DF-1323 and mvdd loop bound DF-1324 (knowns).",
  "recommended_fix": "Clamp all iceland populate walks to SMU71_MAX_LEVELS_GRAPHICS/SMU71_MAX_LEVELS_MEMORY (and MC_REGISTER_ARRAY_SET_COUNT) as in fix.diff; structurally, clamp the counts in smu7_setup_dpm_tables_v0 (DF-1166)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT (nativekernel X86_64_GENERIC, patched, completed 11:59:41, error_count=0)",
  "fix_verdict": "fixed (compile-validated): fix.diff applied to clean guest /usr/src (md5 e3bce6..->1f1e44.., patch-OK); make nativekernel KERNCONF=X86_64_GENERIC completed with error_count=0 and the patched iceland_smumgr.c compiled under -Werror (fix_kernel_full.log:11214). Runtime re-test impossible on this guest (no AMD GPU). Patch reverted after validation (md5 restored).",
  "fix_evidence": "findings/poc/DF-4000/fix_build.log; findings/poc/DF-4000/fix_kernel_full.log; findings/poc/DF-4000/fix.diff"
}