⬢ DragonFlyBSD Kernel Audit
DF-4043 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4043",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel panic: amdhandlemsgreject (amd.c:1452-1525) calls amdsettags(amd, cur_target, FALSE) at amd.c:1485 whenever a MESSAGE REJECT arrives while the active SRB has CAM_TAG_ACTION_VALID and no SDTR is pending (msgout_len==0 on the SEL_W_ATN2 tagged path \u2014 amdstart amd.c:942-954 only writes the tag bytes to the FIFO). amdsettags is a stub: panic(\"Implement me!\") (amd.c:846). A target that reports tag support (or one that simply rejects the tag byte) panics the kernel; the xpt_alloc_ccb at :1483 also leaks. Tag queuing is enabled by default (EEPROM defaults set TAG_QUEUING for all targets, amd.c:2238; AMD_USR_TAGENB at amd.c:2337-2338). Verified by replicating the handlemsgreject branch ladder with msgout_len==0 + active tagged SRB: the tag branch is selected (run.log DF-4043). Requires hostile/broken SCSI target -> runtime inconclusive on this guest (no HBA), source certain.",
  "exploit_chain": "tagged I/O to a target that rejects the SIMPLE Q TAG message -> MSG IN MESSAGE REJECT -> amdhandlemsgreject -> amdsentmsg(SDTR)=FALSE (msgout empty) -> tag branch :1475-1485 -> amdsettags -> panic amd.c:846",
  "evidence": "run.log section DF-4043; VERDICT.md; fix_build.log; env.txt",
  "kernel_refs": [
    "sys/dev/disk/amd/amd.c:846",
    "sys/dev/disk/amd/amd.c:1485",
    "sys/dev/disk/amd/amd.c:1475",
    "sys/dev/disk/amd/amd.c:942",
    "sys/dev/disk/amd/amd.c:2238"
  ],
  "poc_changes": "Pass-2 reviewer authored demonstrator with a verbatim copy of the drivers amdsentmsg walk / handlemsgreject branch ladder / parsemsg DISCONNECT arm so branch selection is the kernels; fix.diff generated against the pristine file and compile-validated via full nativekernel rebuild on the guest (shared build with DF-4036..DF-4044, fix_build.log).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "141db72d1d0fefdd08c49b0a88eb9fe244fa09f9e271000acd39d805a6ebdebd",
  "notes": "Hardware-gated (no AMD53c974 HBA on guest; hostile-SCSI-target threat model; amd(4) in GENERIC but never attaches). Kills: msgin_buf walk bounded (max idx 4), tag byte fits SRB_array[256], msgout shift fits, amdtimeout dead code (#if 0), EEPROM walks fit eepromBuf[128].",
  "recommended_fix": "Implement amdsettags: toggle AMD_CUR_TAGENB in tinfo[target].disc_tag with a target bound",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (nativekernel X86_64_GENERIC rebuilt with all DF-4036..DF-4044 patches; 0 errors under -Werror; see fix_build.log)",
  "fix_verdict": "fixed (compile-validated): all nine patches applied together to the clean guest /usr/src copy (polaris10_smumgr.c md5 6f39bb32..->19a2b278.., amd.c f577a330..->54ce1518..), make -j4 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with 0 compile errors under -Werror; amd.o recompiled into the GENERIC kernel. Runtime re-test impossible on this guest (device absent). Sources restored to pristine and md5-verified after validation.",
  "fix_evidence": "findings/poc/DF-4043/fix.diff; findings/poc/DF-4043/fix_build.log (build banner + compile lines + 0 errors)"
}