⬢ DragonFlyBSD Kernel Audit
DF-4113 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4113",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated. nge_rxeof takes the received frame length from the device-DMA-written 16-bit BUFLEN field (NGE_RXBYTES(cur_rx), sys/dev/netif/nge/if_nge.c:1225; if_ngereg.h:517/527) with no kernel-side clamp, then installs it as the mbuf length on the live x86-64 path (m->m_pkthdr.len = m->m_len = total_len, if_nge.c:1270) on an NGE_JLEN=9024-byte jumbo minicluster with only 9016 usable after the alignment m_adj (if_nge.c:1074; descriptor advertises 9010, if_nge.c:1078). A PKT_OK descriptor with BUFLEN > 9016 (faulty/hostile DP83820 or peer descriptor-DMA corruption) yields up to ~56KB OOB read past the cluster propagated through if_input (if_nge.c:1300) to sockets/BPF (kernel heap info leak) or a page-fault panic; the m_devget fallback path (if_nge.c:1255-1256) reads total_len+2 bytes from the same 9024-byte cluster - equally OOB. Giants are enabled (NGE_RXCFG_RX_GIANTS, if_ngereg.h:306-308) and MTU up to 9000 accepted (if_nge.c:1994): only the compliant chips own descriptor bounds stand between an oversized frame and the OOB. Guest has no NS DP83820 (presence_probe.sh: NGE_ABSENT) - honestly untested; not a false positive: the missing bound is unconditional on every received frame.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4113/VERDICT.md (trace if_nge.c:1225/1270/1255-1256/1074/1078/1300/1233-1237, if_ngereg.h:517/527/604-609); presence_probe.sh + env.txt; fix.diff (NGE_JLEN clamp + recycle)",
  "kernel_refs": [
    "sys/dev/netif/nge/if_nge.c:1225",
    "sys/dev/netif/nge/if_nge.c:1270",
    "sys/dev/netif/nge/if_nge.c:1255",
    "sys/dev/netif/nge/if_nge.c:1074",
    "sys/dev/netif/nge/if_nge.c:1300",
    "sys/dev/netif/nge/if_ngereg.h:527",
    "sys/dev/netif/nge/if_ngereg.h:604"
  ],
  "poc_changes": "No seed PoC. Hardware-gated (no DP83820 on guest); presence probe only.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "(none - hardware-gated; presence_probe.sh only)",
  "run_cmd": "vm.sh run_root ifconfig -l; pciconf -l | grep 0x0022100b  # -> NGE_ABSENT",
  "code_hash": "SKIP-HW-GATED-4113",
  "notes": "Read primitive only (no write). Same device-length-trust family as DF-4110 (tl). Distinct from known DF-1384 (jref/jfree jumbo TOCTOU) - that is an allocation-lifetime race, this is a missing input bound.",
  "recommended_fix": "Clamp NGE_RXBYTES() to NGE_JLEN - sizeof(uint64_t) in nge_rxeof and recycle the descriptor (PKT_OK-error-path shape) when exceeded.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch --dry-run clean); cannot be validated on a guest without DP83820 hardware.",
  "fix_evidence": "findings/poc/DF-4113/fix.diff"
}