⬢ DragonFlyBSD Kernel Audit
DF-4047 / run.log
← back to finding ↓ download raw
== DF-4047 model: crafted-VBIOS revision -> NULL helper call ==
(call *NULL)(...) in the kernel == immediate page-fault panic)

DCE11.0, DIGx rev absent/0 + DIG1 crev=1  -> assign_control_parameter
DCE11.0, UNIPHYTransmitterControl crev=2 -> transmitter_bp_to_atom
DCE11.0, UNIPHYTransmitterControl crev=4 -> clock_source_id_to_ref_clk_src
DCE11.2, DIGx rev 0 + DIG2 crev=1        -> assign_control_parameter
DCE11.0 honest (DIGx v4, UNIPHY v5)     -> safe (no NULL call)
DCE8.0  crafted (DIGx 0/DIG1 v1, UNIPHY v2/v4) -> safe (dce80 table fully populated)

expected NULL-call sites in command_table.c:
  :204 bp->cmd_helper->assign_control_parameter (encoder_control_dig1_v1)
  :219 bp->cmd_helper->assign_control_parameter (encoder_control_dig2_v1)
  :507 bp->cmd_helper->transmitter_bp_to_atom   (transmitter_control_v2)
  :678 cmd->clock_source_id_to_ref_clk_src      (transmitter_control_v4)
  :367-375 uninit 'crev' steering when UNIPHY cmd absent (CWE-457)
== DF-4047 model: crafted-VBIOS revision -> NULL helper call ==
(call *NULL)(...) in the kernel == immediate page-fault panic)

DCE11.0, DIGx rev absent/0 + DIG1 crev=1  -> assign_control_parameter
DCE11.0, UNIPHYTransmitterControl crev=2 -> transmitter_bp_to_atom
DCE11.0, UNIPHYTransmitterControl crev=4 -> clock_source_id_to_ref_clk_src
DCE11.2, DIGx rev 0 + DIG2 crev=1        -> assign_control_parameter
DCE11.0 honest (DIGx v4, UNIPHY v5)     -> safe (no NULL call)
DCE8.0  crafted (DIGx 0/DIG1 v1, UNIPHY v2/v4) -> safe (dce80 table fully populated)

expected NULL-call sites in command_table.c:
  :204 bp->cmd_helper->assign_control_parameter (encoder_control_dig1_v1)
  :219 bp->cmd_helper->assign_control_parameter (encoder_control_dig2_v1)
  :507 bp->cmd_helper->transmitter_bp_to_atom   (transmitter_control_v2)
  :678 cmd->clock_source_id_to_ref_clk_src      (transmitter_control_v4)
  :367-375 uninit 'crev' steering when UNIPHY cmd absent (CWE-457)
RUN4047_RC=0