⬢ DragonFlyBSD Kernel Audit
DF-4120 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4120",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Arithmetic certain, field plausibility likely, runtime hardware-gated. cypress_populate_mclk_values second spread-spectrum division (cypress_dpm.c:566-567) divides by clk_s*625; clk_s (computed at :565 as reference_clock*5/(decoded_ref*ss.rate)) truncates to 0 whenever decoded_ref*ss.rate > reference_clock*5, turning :567 into a divide-by-zero (#DE kernel panic) even with ss.rate != 0 \u2014 a different expression and condition from known DF-1387 (rate==0 at :565). Inputs are VBIOS-controlled: ss.rate raw u16 usSpreadRateInKhz (radeon_atombios.c:1546), decoded_ref 1..~15 (rv740_get_decoded_reference_divider), reference_clock = mpll.reference_freq (10000 typical, 2700 on 27 MHz boards). Panic examples: (2700,2,6751), (10000,2,25001), (10000,1,50001). Reachable at DPM enable and every power-state change when mclk_ss + matching ASIC_INTERNAL_MEMORY_SS entry exist \u2014 same gating as accepted DF-1387. Expression byte-identical in upstream Linux (checked 2026-09-18).",
  "exploit_chain": "Crafted VBIOS ss.rate (25-50+ MHz range, physically implausible for real SS silicon, trivially craftable in an option-ROM/vBIOS image) on an evergreen-family card with memory-clock SS support -> #DE panic at radeon attach/state-switch.",
  "evidence": "VERDICT.md (arithmetic + worked examples); fix.diff (clk_s==0 bail-out); env.txt",
  "kernel_refs": [
    "sys/dev/drm/radeon/cypress_dpm.c:553",
    "sys/dev/drm/radeon/cypress_dpm.c:565",
    "sys/dev/drm/radeon/cypress_dpm.c:566",
    "sys/dev/drm/radeon/cypress_dpm.c:567",
    "sys/dev/drm/radeon/radeon_atombios.c:1546"
  ],
  "poc_changes": "No seed PoC; hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Sibling of known DF-1387 (lines 553-565, rate==0 form); this finding covers the clk_s==0 form of the SECOND division at :567 \u2014 outside DF-1387s cited range and condition. Family precedent: DF-1334/1376/1386/1387.",
  "recommended_fix": "Return -EINVAL when clk_s truncates to 0 between the two divisions (fix.diff); complements the DF-1387 rate==0 guard.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Diff authored; validation requires evergreen hardware absent from the audit guest.",
  "fix_evidence": "fix.diff"
}