⬢ DragonFlyBSD Kernel Audit
DF-4107 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4107",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain: vge_rxeof takes total_len from the DMA-written 14-bit VGE_RDSTS_BUFSIZ field (if_vge.c:1268, if_vgevar.h:55-56, if_vgereg.h:676) and the single-fragment completion path assigns it straight into m->m_pkthdr.len/m->m_len (if_vge.c:1361-1363) with no MCLBYTES bound - up to 16379 on a 2048-byte cluster (~14KB heap OOB read into if_input/BPF; DF-3604/DF-4055/DF-4083 family) and a -4 signed length when BUFSIZ<4. Multi-frag pkthdr.len (1360) is likewise unbounded vs the chain. Untestable on the audit guest (virtio NIC only, no VIA 1106:3053).",
  "exploit_chain": "",
  "evidence": "VERDICT.md trace with the three macro cites; single-cluster allocation proof at vge_newbuf:1111-1134 and tag maxsize MCLBYTES at if_vge.c:765-768.",
  "kernel_refs": [
    "sys/dev/netif/vge/if_vge.c:1268",
    "sys/dev/netif/vge/if_vge.c:1361",
    "sys/dev/netif/vge/if_vge.c:1360",
    "sys/dev/netif/vge/if_vgevar.h:55",
    "sys/dev/netif/vge/if_vgereg.h:676"
  ],
  "poc_changes": "No runnable PoC (no VT612x hardware on guest); pack is the trace + clamp fix.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (NIC = virtio vtnet0; no VIA 1106:3053)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardware-gated. Same trust posture as the accepted family findings (DF-3604 bce Medium, DF-4055 et Medium, DF-4083 sis Medium) - severity aligned at Medium. Distinct from known DF-1381 (newbuf chunk decrement) and DF-1382 (MTU clamp).",
  "recommended_fix": "Clamp total_len to MCLBYTES - VGE_ETHER_ALIGN and drop frames with total_len <= ETHER_CRC_LEN before touching m_len/pkthdr.len (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the MCLBYTES clamp + degenerate-length drop at the top of the descriptor loop; not exercisable on the guest (driver cannot attach without the NIC).",
  "fix_evidence": "findings/poc/DF-4107/fix.diff"
}