{ "finding_id": "DF-4059", "status": "reproduced", "reproduced": true, "impact": "panic", "confidence": "certain", "verdict": "REPRODUCED via production-handler KLD dispatch rig (DF-4240 class): the shipped X86_64_GENERIC kernels own amr_done/amr_start/amr_std_get_work (nm-resolved, prologue-verified) execute over a fabricated post-attach softc with real bus_dma and production command clusters. (A) Idle controller + one completion id 0: idx=-1 makes amr_done read amr_busycmd[-1] -- empirically &sc->amr_ready.stqh_first, non-NULL after production attach -- and drive it through amr_freeslot as an amr_command*; ac->ac_sc lands on the softc interior and the slot byte on amr_busycmd[0], so the production NULL-slot guard fires: panic(\"amr: slot 0 not busy?\") in amr_done+0x134. One controller-supplied byte = guaranteed kernel panic on the interrupt path. (B) Slot busy: same forged pointer steers a NULL store at &amr_ready+1552+8*slot (arbitrary softc fields for heap-groomed slot bytes >= 63), an atomic decrement at softc+5128 -- 1208 bytes past the 3920-byte softc -- and stores mb_status into the live amr_busycmd[0] pointer (all observed, guest alive). Accidental third facet: after a production EBUSY requeue, amr_busycmd[-1] is a REAL amr_command, so id 0 double-frees a live commands slot (observed panic \"amr: slot 1 not busy?\"). (C) std-firmware mb_nstatus=255: the loop reads mb_completed[46..254], 209 bytes past the 82-byte stack mailbox, and every byte is disclosed via the production \"bad slot %d completed\" print -- kernel heap pointers (0xfffff8xxxxxxxxx) and caller-frame patterns captured, 6/255 bytes differ between call depths 2 and 7 (live stack). Threat model: malicious/faulty MegaRAID or mailbox DMA; root-only /dev/amr0 poll paths. Fix (clamp loop to nitems(mb_completed)=46 + reject id 0) validated on a rebuilt nativekernel: id rejected, zero stores, 46 entries max, zero stack disclosure, guest alive.", "exploit_chain": "controller firmware/DMA writes completion mailbox id 0 -> amr_std_get_work bcopy -> amr_done idx=-1 -> amr_busycmd[-1] (= &amr_ready.stqh_first, or &requeued_cmd after EBUSY) treated as amr_command* -> amr_freeslot deref/write through forged ac_sc (softc-interior) with heap-byte-steered slot -> NULL store into arbitrary softc field + atomic decrement 1208B past the softc + status byte into the live busycmd[] pointer; idle variant = production panic; nstatus>46 variant = 209-byte stack overread disclosed to the log. No unpriv->root: 0600 root device + hardware precondition; ceiling is one-byte-panic + heap-directed corruption + stack info disclosure.", "evidence": "VERDICT.md (full narrative + numbers); bootB_serial.log / panic_4059A.txt (idle-controller panic: panic: amr: slot 0 not busy? amr_done+0x134); bootA_serial.log (4059B controlled stores: NULL @softc+3088, decr 0x4000->0x3fff @softc+5128, busycmd[0] byte4=0x5a); leak2.serial.txt / leak7.serial.txt (255 entries each, 209 stack bytes, differing at 6/255 positions between depths); dmesg_patched.txt + fix_run.log (bad completion id 0 / excessive completion count 255 / 46 entries / no stores / guest alive)", "kernel_refs": [ "sys/dev/raid/amr/amr.c:1786", "sys/dev/raid/amr/amr.c:1788", "sys/dev/raid/amr/amr.c:1789", "sys/dev/raid/amr/amr.c:1795", "sys/dev/raid/amr/amr.c:1798", "sys/dev/raid/amr/amr.c:1500", "sys/dev/raid/amr/amr.c:1510", "sys/dev/raid/amr/amr.c:196", "sys/dev/raid/amr/amrreg.h:433", "sys/dev/raid/amr/amrvar.h:230", "sys/dev/raid/amr/amrvar.h:231" ], "poc_changes": "No seed sources existed (pack was source-only hardware-gated). Built the DF-4240-class production-handler KLD dispatch rig from scratch: dfamr_rig.c + dfamr_ctl.c. Key rig facts: amr compiled into X86_64_GENERIC (nm shows statics); amr_alloccmd_cluster was inlined by gcc 8.3 so its body is a verbatim copy; the virtual card uses a X86_64_BUS_SPACE_MEM register file, and rig_get_work wraps production amr_std_get_work only to model the card-side interrupt-line drop (a memory file cannot react to the drivers ack write); struct offsets measured at runtime (ac_link is ONE pointer: ac_sc=8, ac_slot=16 -- the pass-2 layout guesses in early rig iterations were corrected by the measured offs ioctl and one production panic that exposed the real alias chain).", "attempts": 4, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 5400, "guest_dirty": 0, "build_cmd": "make (bsd.kmod.mk, KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC) && cc -O2 -Wall -o dfamr_ctl dfamr_ctl.c [see build.sh]", "run_cmd": "./dfamr_ctl prime && ./dfamr_ctl offs && ./dfamr_ctl magic && ./dfamr_ctl b && ./dfamr_ctl leak 2 && ./dfamr_ctl leak 7 && ./dfamr_ctl a [baselines: see README.md / run_bootA.sh / run_bootB.sh; patched: run_patched.sh]", "code_hash": "9caf52e072fed47846e29e607ef1c26ea16486b3ce515cc94d9af390c0107483", "notes": "Scope: std-firmware completion path (finding scope); the quartz-side WRITE overflow inside amr_quartz_get_work is DF-1358 (separate fix; the amr_done clamp also protects the quartz-driven downstream loop). Richer alias discovered during verification: after a production EBUSY requeue (amr_setup_data:1597-1600), amr_ready.stqh_last = &requeued_cmd.ac_link, so amr_busycmd[-1] can be a REAL amr_command -- id 0 then double-frees a live commands slot (observed once on serial during rig shakedown; register model corrected afterwards, mechanism line-verified). Impact recorded as panic (the deterministic production outcome); the controlled-write and stack-disclosure facets raise it above pure DoS for hosts with the card. Serial captures in bootA/B_serial.log; the leak dmesg files were lost with a panicked guest disk and re-derived from the serial logs (leak2/7.serial.txt) plus a fresh patched-boot leak capture (dmesg_patched.txt shows the clamped behavior).", "recommended_fix": "In amr_done, clamp the completion loop to nitems(mbox.mb_completed) and reject completion ids < 1 before indexing amr_busycmd", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff (git-apply clean) applied to guest /usr/src, nativekernel KERNCONF=X86_64_GENERIC rebuilt (RC=0, 37878-line log) and installed; rig re-dispatched the PATCHED production handlers (amr_std_poll_command moved +0x50, prologues re-verified): id-0 completion rejected (bad completion id 0) with zero stores; nstatus=255 clamped (excessive completion count 255, exactly 46 entries, zero stack bytes disclosed); former 4059A panic gone; guest alive", "fix_evidence": "fix.diff; fix_build.log (full nativekernel output, RC=0/INSTALL_RC=0); fix_run.log (baseline-vs-patched contrast per scenario); dmesg_patched.txt" }