⬢ DragonFlyBSD Kernel Audit
DF-4048 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4048",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Defect reproduced at the arithmetic level on the guest: symclock_trunc.c replicates transmitter_control_v1_6s deep-color expressions 1:1 (cpu_to_le16((le16_to_cpu(params.ulSymClock)*N)/24) on the 32-bit ULONG ulSymClock, atombios.h:1559-1575) and shows 4/5 realistic HDMI deep-color clocks computed wrong (e.g. 4K60 16bpc: correct 118800, produced 53264; run.log, exit 1). The truncated ulSymClock is handed to the VBIOS via EXEC_BIOS_CMD_TABLE (command_table.c:892), programming a corrupted transmitter symbol clock -> display corruption/link failure for >655.35MHz deep-color modes on v1_6-transmitter DCE11/12 ASICs. Display-level manifestation is hardware-gated (no AMD GPU in guest), hence impact recorded as none; no memory-safety consequence (bounded field write inside the params struct). Also noted: :857 assigns ulSymClock without cpu_to_le32 (BE-only issue).",
  "exploit_chain": "",
  "evidence": "run.log (4/5 TRUNC rows incl. 74250->8714, 89100->23564, 118800->53264, 68000->2464; EXIT=1), VERDICT.md, atombios.h struct quote in README.md",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/command_table.c:857",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:869",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:873",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:877",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:881",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:892",
    "sys/dev/drm/amd/include/atombios.h:1559"
  ],
  "poc_changes": "n/a (authored fresh: exact-expression userland replica; kernel-side field is 32-bit so the le16 helpers truncate on both input and output)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o symclock_trunc symclock_trunc.c",
  "run_cmd": "/root/df4048/symclock_trunc; echo EXIT=$?",
  "code_hash": "8bec8785221b40a8d4139e5760176c6fd536055719225df08b103b0ad75600c9",
  "notes": "Copy-paste from transmitter_control_v1_5 where the field is USHORT usSymClock. Checklist item (f) adjacent: not a div0 - adjust_display_pll_v3 guards its division (command_table.c:1514-1521); killed as negative.",
  "recommended_fix": "Use cpu_to_le32/le32_to_cpu for ulSymClock in transmitter_control_v1_6 (both the :857 assignment and the three deep-color cases); see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel-build validation hardware-gated (no AMD GPU). fix.diff is a mechanical 16->32-bit conversion swap; the arithmetic replicas correct column implements exactly the patched math (all 5 cases then compute correctly).",
  "fix_evidence": "findings/poc/DF-4048/fix.diff; run.log correct column = post-fix expected values"
}