⬢ DragonFlyBSD Kernel Audit
DF-4110 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4110",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated. tl_intvec_rxeof takes the received frame length from the device-DMA-written 16-bit tlist_frsize (sys/dev/netif/tl/if_tl.c:1405) and assigns it unconditionally as m->m_pkthdr.len = m->m_len (if_tl.c:1422) on an m_getcl() MCLBYTES=2048 cluster (if_tl.c:1347). No kernel-side clamp exists; TL_MAXRX=MCLBYTES (if_tl.c:1941) is only a register hint to a compliant chip. A faulty or hostile NIC that sets TL_CSTAT_FRAMECMP with tlist_frsize up to 65535 hands ether_input (if_tl.c:1437) an over-long mbuf: up to ~63KB out-of-bounds read past the cluster, contents propagated up the stack (kernel heap info leak via sockets/BPF) or page-fault panic. Guest has no ThunderLAN device (vtnet0 lo0 only; presence_probe.sh), so the PoC phase is honestly untested; not a false positive - the missing bound is unconditional on every RXEOF.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4110/VERDICT.md (source trace if_tl.c:1347/1400/1405/1422/1437/1941); presence_probe.sh + env.txt (hardware absent on guest); fix.diff (MCLBYTES clamp + in-place recycle)",
  "kernel_refs": [
    "sys/dev/netif/tl/if_tl.c:1405",
    "sys/dev/netif/tl/if_tl.c:1422",
    "sys/dev/netif/tl/if_tl.c:1437",
    "sys/dev/netif/tl/if_tl.c:1347",
    "sys/dev/netif/tl/if_tl.c:1941",
    "sys/dev/netif/tl/if_tlreg.h:75"
  ],
  "poc_changes": "No seed PoC. presence_probe.sh documents the hardware gate; the OOB read cannot be entered on a guest without a ThunderLAN NIC (or a way to inject device-side DMA state).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "(none - hardware-gated; presence_probe.sh only)",
  "run_cmd": "vm.sh run_root sh /root/presence_probe.sh  # -> TL_ABSENT",
  "code_hash": "SKIP-HW-GATED-4110",
  "notes": "Same family as the classic BSD NIC device-length-trust fixes; read primitive only (no write). Severity Medium because exploitation requires attacker-influenced device-side DMA state, not an unprivileged syscall.",
  "recommended_fix": "Clamp total_len to MCLBYTES in tl_intvec_rxeof and recycle the descriptor in place (ENOBUFS-path shape) when exceeded.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch --dry-run clean); cannot be validated on a guest without ThunderLAN hardware.",
  "fix_evidence": "findings/poc/DF-4110/fix.diff"
}