⬢ DragonFlyBSD Kernel Audit
DF-4131 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4131",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent array mismatch: oce_mbox_eqd_modify_periodic fills mbx_modify_common_eq_delay.delay[8] from a caller array sized OCE_MAX_EQ=32 with num<=sc->neqs (oce_mbox.c:1933-1940, oce_if.c:1872/1930). Unreachable on DragonFly today \u2014 MSI-X is #if 0d (oce_if.c:604-628) forcing intr_count=1 => neqs=1, and even with MSI-X re-enabled intr_count<=MAX(nrqs-1<=8, nwqs<=8)=8 == delay[8] exactly. Any future raise of OCE_MAX_RSS/OCE_MAX_WQ past 8 converts it into a kernel stack overflow on the periodic timer path. Info-severity hardening: clamp num to 8 (the protocol maximum) at the mailbox boundary.",
  "exploit_chain": "",
  "evidence": "hw_absent.log (no OCE hardware on the audit guest); reachability analysis in README.md citing oce_if.c:604-628, oce_mbox.c:2121-2130",
  "kernel_refs": [
    "sys/dev/netif/oce/oce_mbox.c:1786",
    "sys/dev/netif/oce/oce_mbox.c:1795",
    "sys/dev/netif/oce/oce_mbox.c:1933",
    "sys/dev/netif/oce/oce_mbox.c:1940",
    "sys/dev/netif/oce/oce_if.c:1872",
    "sys/dev/netif/oce/oce_if.c:1930",
    "sys/dev/netif/oce/oce_if.h:140",
    "sys/dev/netif/oce/oce_if.c:604"
  ],
  "poc_changes": "no seed; source analysis (unreachable by construction on this tree/guest)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (source-level)",
  "code_hash": "",
  "notes": "Filed as Info hardening per the severity rubric (hardening opportunity, no demonstrated impact). Not a re-report of DF-1395/DF-1396.",
  "recommended_fix": "clamp num to the protocol bound 8 (delay[8]) at the top of oce_mbox_eqd_modify_periodic",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not runtime-testable: path requires OCE hardware and a configuration (neqs>8) that DragonFly cannot reach as shipped",
  "fix_evidence": "hw_absent.log + reachability analysis"
}