⬢ DragonFlyBSD Kernel Audit
DF-4050 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4050",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "adjust_display_pll_v2 (command_table.c:1457-1477) fills the ADJUST_DISPLAY_PLL_PS_ALLOCATION inputs and returns BP_RESULT_FAILURE without ever calling EXEC_BIOS_CMD_TABLE(AdjustDisplayPll, ...) or processing the output - the stale comment at :1464-1465 (convert output pixel clock back 10KHz-->KHz) refers to the missing processing and the v3 sibling (:1479-1530, complete with the pixel_clk_10KHz_in != 0 guard) shows the intended shape. On crev-2 AdjustDisplayPll VBIOSes the handler is selected by init_adjust_display_pll (:1440-1455) and then unconditionally fails, so the BIOS-side PLL adjustment is silently skipped (dce_clock_source.c:444-451 degrades gracefully). Functional/dead-code defect, no memory unsafety; Info severity. Confidence likely only because the upstream Linux reference was unreachable during the audit (offline); all in-tree signals indicate dropped code. Not runtime-verified: hardware-gated (no AMD GPU).",
  "exploit_chain": "",
  "evidence": "README.md/VERDICT.md with the function quote and v2/v3 contrast",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/command_table.c:1457",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:1464",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:1476",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:1479",
    "sys/dev/drm/amd/display/dc/dce/dce_clock_source.c:444"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Killed as memory-safety candidate: no sink, pure dead path.",
  "recommended_fix": "Restore the EXEC + output-processing block mirroring adjust_display_pll_v3 (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated; fix restores the v3-shaped execution block, source-level only.",
  "fix_evidence": "findings/poc/DF-4050/fix.diff"
}