⬢ DragonFlyBSD Kernel Audit
DF-4119 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4119",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source certain, upstream-verified, runtime hardware-gated. cypress_dpm.c:2059-2064 uses the ATOM-computed engine-PLL reference divider only when radeon_atom_get_clock_dividers FAILS (consuming the uninitialized stack `dividers` declared at :2029) and hardcodes R600_REFERENCEDIVIDER_DFLT (4) on success — inverted. Sink: pi->ref_div at rv770_dpm.c:815 MPLL_LOCK_TIME(R600_MPLLLOCKTIME_DFLT * pi->ref_div) and engine-speed parameter programming: wrong memory-PLL lock timings on all functional hardware, garbage-derived timings when the ATOM call fails. Upstream Linux master carries the identical inverted condition in cypress_dpm.c and btc_dpm.c (checked 2026-09-18), the same basis on which the btc twin DF-3976 was filed. Functional/uninitialized-stack-read-into-hw-programming defect; no kernel memory-safety sink.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; fix.diff (one-line inversion); env.txt",
  "kernel_refs": [
    "sys/dev/drm/radeon/cypress_dpm.c:2029",
    "sys/dev/drm/radeon/cypress_dpm.c:2059",
    "sys/dev/drm/radeon/cypress_dpm.c:2062",
    "sys/dev/drm/radeon/rv770_dpm.c:815"
  ],
  "poc_changes": "No seed PoC; hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Cypress twin of DF-3976 (btc_dpm.c:2602-2607). Upstream comparison fetched 2026-09-18 from torvalds/linux master: both files carry `if (ret)`.",
  "recommended_fix": "Invert the check to `if (!ret)` (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line fix authored; validation requires evergreen hardware absent from the audit guest.",
  "fix_evidence": "fix.diff"
}