⬢ DragonFlyBSD Kernel Audit
DF-4156 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4156",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "agg_attach() destroys the AC97 codec on the pcm_register()-failure error path without first tearing down the mixer that mixer_init() created, leaving the 0666 /dev/mixerN with dangling si_drv1->devinfo and a kobj_deleted methods table; any subsequent mixer ioctl on that node is a UAF with indirect-dispatch potential. Trigger precondition (pcm_register failing after mixer_init: pcm_veto_load stuck / unit > PCMMAXUNIT) is a boot-time anomaly an unprivileged user cannot create, and the audit guest has no Maestro hardware, so untested rather than demonstrated.",
  "exploit_chain": "",
  "evidence": "maestro.c:1894-1903 (mixer_init then pcm_register), maestro.c:1922-1924 (bad: ac97_destroy without mixer_uninit), mixer.c:730-733 (make_dev 0666 + si_drv1), mixer.c:635 (m->devinfo=codec), ac97.c:852-859 (kobj_delete+kfree), sound.c:1021-1027 (pcm_register failure set), sound.c:1205 (correct unwind order in pcm_unregister); run.log (no maestro/pcm on guest)",
  "kernel_refs": [
    "sys/dev/sound/pci/maestro.c:1894",
    "sys/dev/sound/pci/maestro.c:1901",
    "sys/dev/sound/pci/maestro.c:1923",
    "sys/dev/sound/pcm/mixer.c:730",
    "sys/dev/sound/pcm/mixer.c:635",
    "sys/dev/sound/pcm/ac97.c:852",
    "sys/dev/sound/pcm/sound.c:1021",
    "sys/dev/sound/pcm/sound.c:1205"
  ],
  "poc_changes": "authored fresh probe (no seed); probe documents precondition absence on guest",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 4,
  "guest_dirty": 0,
  "build_cmd": "cc -O -Wall -o /root/maestro_probe /root/maestro_probe.c",
  "run_cmd": "/root/maestro_probe; pciconf -lv | grep -i -A1 maestro; ls -l /dev/mixer* /dev/dsp*",
  "code_hash": "90980191770bbac49eb3cc3a67b94401e1f2bc9ebbda6523ee237a7bb554c469",
  "notes": "Related cleanup asymmetry fixed in the same diff: agg_detach() never ac97_destroy()s ess->codec (leak on module unload). Severity Low strictly because the precondition is not attacker-creatable; impact-if-precondition is UAF with control-flow potential.",
  "recommended_fix": "Call mixer_uninit(dev) before ac97_destroy(codec) on the attach failure path when the mixer was initialized; destroy the codec in agg_detach()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No trigger environment on the audit guest (no Maestro hardware; pcm_register failure precondition not creatable), so baseline vs patched behaviour cannot be observed. fix.diff applies cleanly (git apply --check) and mirrors the pcm_unregister() unwind order (mixer_uninit before codec free).",
  "fix_evidence": "findings/poc/DF-4156/fix.diff (git apply --check clean); sound.c:1205 shows the canonical order"
}