⬢ DragonFlyBSD Kernel Audit
DF-4117 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4117",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime hardware+OOM-gated (family convention of DF-3973/DF-4023). rv7xx_parse_power_tables per-state kzalloc failure (rv770_dpm.c:2306-2310) kfrees rdev->pm.dpm.ps without NULLing it and without freeing ps_priv[0..i-1]; num_ps stays 0. cypress_dpm_init (cypress_dpm.c:2050-2052) propagates but leaks eg_pi; the error is swallowed twice (radeon_pm.c:1448 discards .dpm.inits return; evergreen.c:5235 calls radeon_pm_init() as a void statement), so attach completes with dpm_enabled=false and ps dangling. At unload/reboot radeon_pm_fini_dpm -> radeon_dpm_fini runs unconditionally (radeon_pm.c:1705) -> cypress_dpm_fini:2150-2153: num_ps==0 skips the ps_priv loop (leak) and kfree(rdev->pm.dpm.ps) at :2153 double-frees the block freed at parse time => kmalloc freelist corruption/panic at unload. Cypress dispatch (radeon_asic.c:1405) instance of the DF-3645/3755/3955/3973/4023 family; this files knowns (DF-1385/1386/1387) do not cover lifecycle.",
  "exploit_chain": "On CYPRESS/HEMLOCK/JUNIPER/REDWOOD/CEDAR hardware: many-state crafted VBIOS + attach-time kernel memory pressure forcing the kzalloc at rv770_dpm.c:2306 to fail; double error-swallow keeps the driver attached; kldunload/reboot double-frees the ps array. Trigger point is boot/attach (physical/vBIOS access) \u2014 realistic ceiling DoS, not an unprivileged remote path.",
  "evidence": "VERDICT.md (chain with path:line); fix.diff (parse-path cleanup + init cleanup + idempotent fini); env.txt (hardware absence)",
  "kernel_refs": [
    "sys/dev/drm/radeon/cypress_dpm.c:2032",
    "sys/dev/drm/radeon/cypress_dpm.c:2050",
    "sys/dev/drm/radeon/cypress_dpm.c:2146",
    "sys/dev/drm/radeon/cypress_dpm.c:2153",
    "sys/dev/drm/radeon/rv770_dpm.c:2306",
    "sys/dev/drm/radeon/rv770_dpm.c:2308",
    "sys/dev/drm/radeon/rv770_dpm.c:2331",
    "sys/dev/drm/radeon/radeon_pm.c:1448",
    "sys/dev/drm/radeon/radeon_pm.c:1705",
    "sys/dev/drm/radeon/evergreen.c:5235",
    "sys/dev/drm/radeon/radeon_asic.c:1405"
  ],
  "poc_changes": "No seed PoC; hardware-gated (no AMD evergreen GPU on the audit guest), pack follows the DF-3973/DF-4023 convention.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Cypress-dispatch twin of DF-4023 (rv770) / DF-3973 (btc); shared root site rv770_dpm.c:2306. No evergreen hardware ever attached to the audit guest.",
  "recommended_fix": "Free ps_priv[0..i-1] and NULL rdev->pm.dpm.ps in the parse error path; free eg_pi on cypress_dpm_init early failure; make cypress_dpm_fini idempotent (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Diff authored (same shape as the family fixes) but kernel-level validation requires evergreen hardware absent from the audit guest.",
  "fix_evidence": "fix.diff; VERDICT.md"
}