⬢ DragonFlyBSD Kernel Audit
DF-4118 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4118",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime hardware-gated. rdev->pm.dpm.boot_ps is set only under ATOM_PPLIB_CLASSIFICATION_BOOT (rv770_dpm.c:2172-2173); two crafted-VBIOS shapes reach a NULL deref through this files dispatch: (a) power table parses but no BOOT-classified state -> cypress_dpm_enable:1837-1839 cypress_force_mc_use_s0(rdev, NULL) -> rv770_get_ps(NULL) reads rps->ps_priv at NULL+offset (rv770_dpm.c:53-57) -> page fault; (b) cypress_dpm_init fails (missing PowerPlayInfo header / DF-4117 alloc failure) but radeon_pm.c:1448 discards .dpm.inits error and evergreen.c:5235 calls radeon_pm_init() as a statement, so radeon_dpm_enable executes on the kzalloc-zeroed eg_pi and, with SMC firmware present, cypress_init_smc_table(rdev, NULL) at cypress_dpm.c:1878 -> cypress_populate_smc_initial_state:1242 -> rv770_get_ps(NULL) -> page fault at boot/module-load. cypress_dpm_disable:1953 has the same latent deref. Twin of DF-4022/3972/3754; this files knowns (DF-1385/1386/1387) do not cover it.",
  "exploit_chain": "Crafted/missing BOOT-state VBIOS on an evergreen-family card -> kernel page-fault panic at radeon attach (DPM default-on) -> persistent boot DoS; precondition is physical/vBIOS access (option-ROM/vBIOS flash), matching the acceptance basis of the filed btc/rv770/ni twins.",
  "evidence": "VERDICT.md (both sub-paths with path:line); fix.diff (early boot_ps guards); env.txt (hardware absence)",
  "kernel_refs": [
    "sys/dev/drm/radeon/cypress_dpm.c:1811",
    "sys/dev/drm/radeon/cypress_dpm.c:1837",
    "sys/dev/drm/radeon/cypress_dpm.c:1839",
    "sys/dev/drm/radeon/cypress_dpm.c:1878",
    "sys/dev/drm/radeon/cypress_dpm.c:1184",
    "sys/dev/drm/radeon/cypress_dpm.c:1242",
    "sys/dev/drm/radeon/cypress_dpm.c:1953",
    "sys/dev/drm/radeon/rv770_dpm.c:53",
    "sys/dev/drm/radeon/rv770_dpm.c:2172",
    "sys/dev/drm/radeon/radeon_pm.c:1448",
    "sys/dev/drm/radeon/evergreen.c:5235"
  ],
  "poc_changes": "No seed PoC; hardware-gated (no AMD evergreen GPU on the audit guest).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Cypress-dispatch twin of DF-4022 (rv770) / DF-3972 (btc) / DF-3754 (ni). Sub-path (b) shares the double error-swallow with DF-4117.",
  "recommended_fix": "Reject enable/disable when rdev->pm.dpm.boot_ps == NULL (fix.diff guards in cypress_dpm_enable/cypress_dpm_disable); long-term: honor dpm.init failure in radeon_pm.c.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Diff authored but kernel-level validation requires evergreen hardware absent from the audit guest.",
  "fix_evidence": "fix.diff; VERDICT.md"
}