⬢ DragonFlyBSD Kernel Audit
DF-4076 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4076",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-level likely, chip-gated. The per-command request-frame slot size is facts->IOCRequestFrameSize*4 (mps.c:750,851-854), taken verbatim from the controllers IOC facts reply (U16, doorbell-read at :1043) and never validated against the largest MPI2 request the driver builds. mps_update_events() writes a full MPI2_EVENT_NOTIFICATION_REQUEST (~56B incl. 16B EventMasks) at :1703-1714, mps_read_config_page() a full MPI2_CONFIG_REQUEST + SGE at :2183-2214, mps_get_portfacts() at :574-576. A controller reporting IOCRequestFrameSize < ~16 dwords makes every builder overwrite adjacent slots inside the req_frames DMA mapping, and for the last slot (SMID num_reqs-1) write past the mapping entirely. No minimum check exists anywhere in the driver (only a printf at mps_table.c:221).",
  "exploit_chain": "",
  "evidence": "grep IOCRequestFrameSize: used for sizing at mps.c:750/:772/:820-823/:851-854, echoed to sysctl/log only (mps_table.c:221), never validated",
  "kernel_refs": [
    "sys/dev/raid/mps/mps.c:750",
    "sys/dev/raid/mps/mps.c:851",
    "sys/dev/raid/mps/mps.c:1703",
    "sys/dev/raid/mps/mps.c:2183",
    "sys/dev/raid/mps/mpi/mpi2_ioc.h:272"
  ],
  "poc_changes": "n/a (source-level)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level finding)",
  "run_cmd": "n/a (hardware-gated; source-level analysis)",
  "code_hash": null,
  "notes": "Marked likely only because exploitation requires a controller that violates the MPI2 minimum frame size (malicious/broken firmware).",
  "recommended_fix": "Validate facts->IOCRequestFrameSize at attach (reject/clamp below the largest request struct the driver builds, e.g. < sizeof(MPI2_CONFIG_REQUEST)/4).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}