⬢ DragonFlyBSD Kernel Audit
DF-4098 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4098",
  "status": "reproduced",
  "verdict": "REPRODUCED at both cited panic sites with production code from the shipped kernel image: (1) btdone panics (panic: bt9: Invalid Action code, bt.c:1517, btdone+0x4d3) on a valid I/O CCB completed with the single device-fed btstat byte BTSTAT_INVALID_ACTION_CODE (0x15) -- three sibling panics at bt.c:1520/1524/1527 switch on the same HBA-owned byte (1520 exercised live in DF-4097); (2) btreset panics (btreset - Diagnostic Active failed to drop, bt.c:1650, btreset+0x266) when the wedged controller holds DIAG_ACTIVE -- precisely the condition a reset exists to recover from. Hostile/wedged-controller -> immediate kernel panic, interrupt-path reachable.",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "compromised/wedged BusLogic HBA (or target-induced error) writes btstat 0x15/0x16 into the CCB completion or holds DIAG_ACTIVE -> bt_intr->bt_intr_locked->btdone panic at bt.c:1517 (or bttimeout->btreset panic at bt.c:1650) -> kernel DoS while holding bt->lock",
  "evidence": "panic_btdone.txt (panic + btdone+0x4d3 backtrace after comp_code=0x04 btstat=0x15); panic_btreset.txt (panic + btreset+0x266 after 10s DIAG_ACTIVE stuck); run_panic_*.log for the dispatch context",
  "kernel_refs": [
    "sys/dev/disk/buslogic/bt.c:1517",
    "sys/dev/disk/buslogic/bt.c:1520",
    "sys/dev/disk/buslogic/bt.c:1524",
    "sys/dev/disk/buslogic/bt.c:1527",
    "sys/dev/disk/buslogic/bt.c:1650"
  ],
  "poc_changes": "rig stands in for missing PCI hardware only; the virtual HBA scripts STATUS_REG=0x80 stuck (vhba_enable=0) for the btreset variant; both panics needed separate boots (one panic per boot)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 160,
  "guest_dirty": 0,
  "build_cmd": "./push_rig.sh",
  "run_cmd": "sh run_panic_btdone.sh; (fresh boot) sh run_panic_btreset.sh",
  "code_hash": "745f8b43787e6bb6a37f62b8ac9fc1a99d7aab498a1faa6d34c8caeba4ba8651",
  "notes": "btreset variant takes ~15s (5s + 10s DELAY poll loops) before the panic; both panic texts captured from the serial console",
  "recommended_fix": "Replace all five panic() sites with device_printf + error completion (CAM_REQ_CMP_ERR / ETIMEDOUT) -- never trust HBA-fed bytes or reset state with the kernels life (fix.diff, object-compile validated)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "object-compile validation only (panic class, kernel A/B not mandated): patched bt.c compiles clean under -Werror with kernel headers",
  "fix_evidence": "fix.diff; FIXED-COMPILES-CLEAN with bt.fixed.o on the guest"
}