⬢ DragonFlyBSD Kernel Audit
DF-4103 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4103",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain: amdgpu_atombios_encoder_setup_dig_transmitter (:837/:848), setup_dig_encoder (:648/:668), setup_dig (:1402/:1414 NULL write) and set_crtc_source (:1617/:1686) all dereference amdgpu_encoder->enc_priv unguarded; enc_priv is NULL whenever amdgpu_atombios_encoder_get_lcd_info() fails (missing LVDS_Info VBIOS table, atombios_encoders.c:2081) or get_dig_info()/kzalloc fails. Boot-time sink: dce_v{8,10,11}_0_hw_init -> amdgpu_atombios_encoder_init_dig (:1744/:1758). Result is a NULL-page read/write -> deterministic kernel panic (DoS), not code execution. Not runnable: the QEMU audit guest has no AMD GPU (pciconf: bochs 1234:1111 only), so the driver never attaches.",
  "exploit_chain": "",
  "evidence": "VERDICT.md table of the four unguarded sinks; contrast with the existing guard at atombios_encoders.c:91-93; dce_v10_0.c:3516-3528 enc_priv assignment sites; dce_v10_0.c:2829-2839 boot-path caller.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:837",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:848",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:648",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:668",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:1402",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:1414",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:1617",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:1686",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2069",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:3516"
  ],
  "poc_changes": "No PoC possible on guest (hardware absent); evidence pack is a source-level trace instead of a runnable trigger.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (no AMD GPU: pciconf -l shows bochs 1234:1111)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardware-gated (AMD GPU + LCD-supporting UNIPHY encoder + crafted VBIOS or boot-time kzalloc failure). amdgpu twin of DF-3957 (radeon). Impact ceiling: fatal trap / boot failure of the graphics driver - DoS only; NULL page is unmapped on DFly amd64. Checklist items (a)/(b)/(d) (engine-clock SS div0, percentage_divider, encoder_crtc_dig_mode tables) do not exist in this DFly file - they live in atombios_crtc.c / amdgpu_atombios.c (other files).",
  "recommended_fix": "Guard every enc_priv dereference with if (!dig) return/break, mirroring atombios_encoders.c:91-93.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds NULL guards to the four sink functions; cannot be kernel-built/tested on the guest because the amdgpu driver has no hardware to attach to.",
  "fix_evidence": "findings/poc/DF-4103/fix.diff"
}