⬢ DragonFlyBSD Kernel Audit
DF-4159 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4159",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "xe_intr() RX drop paths (zero-length frame at if_xe.c:756-759, MGETHDR failure at :769-773, MCLGET failure at :775-781) continue without writing XE_DO=XE_DO_SKIP_PACKET (0x8000, the only packet release, at :843). ESR.FULL_PACKET_RX stays asserted for the unreleased packet so the loop at :742 spins forever in hard-interrupt context holding the ifnet serializer - permanent system hang. Register semantics cross-validated against Linux xirc2ps_cs.c (unconditional per-iteration skip, clear the received/dropped/error packet). Logic-model harness built+run on the audit guest confirms: as-written code livelocks on all three drop paths; one-line fix terminates. Kernel/hardware-level run impossible: no Xircom PCMCIA hardware exists in the QEMU guest.",
  "exploit_chain": "local unprivileged user exhausts mbuf clusters (M_NOWAIT MGETHDR/MCLGET fails) while a remote peer sends one frame to the xe interface -> xe_intr spins forever holding if_serializer -> hard hang requiring power cycle. DoS only; no corruption primitive.",
  "evidence": "run.log (scenarios 2-4 LIVELOCK vs 5-6 fixed), livelock_harness.c (verbatim loop copy), VERDICT.md (path:line trace + Linux cross-validation), fix.diff",
  "kernel_refs": [
    "sys/dev/netif/xe/if_xe.c:742",
    "sys/dev/netif/xe/if_xe.c:756",
    "sys/dev/netif/xe/if_xe.c:769",
    "sys/dev/netif/xe/if_xe.c:775",
    "sys/dev/netif/xe/if_xe.c:843",
    "sys/dev/netif/xe/if_xereg.h:219",
    "sys/dev/netif/xe/if_xereg.h:247"
  ],
  "poc_changes": "n/a (new finding, pass 2); harness authored from the if_xe.c loop verbatim",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (harness-only; no Xircom hardware)",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o livelock_harness livelock_harness.c (on DF guest)",
  "run_cmd": "./run.sh  (livelock_harness MODE FAIL_MGET FAIL_MCL LEN_ZERO)",
  "code_hash": "cadf978bd1aa1bea0f65139c56b625f5be30ac52010e3d9e636f2b449b2157e9",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "logic-model MODE=1 scenarios terminate in 1 iteration with the packet released; kernel-level fix validation impossible without Xircom PCMCIA hardware (driver never attaches in the guest)",
  "fix_evidence": "run.log scenarios 5-6; fix.diff",
  "notes": "Distinct from pass-1 DF-1410 (copy-bound overflow): DF-4159 is the packet-release control flow, present even for in-bounds lengths. FreeBSD 10.3 (last release with this driver) shares the bug; Linux xirc2ps_cs.c for the same silicon documents the mandatory unconditional skip.",
  "recommended_fix": "Write XE_DO=0x8000 (skip packet) before each of the three continue drop paths in xe_intr()s RX loop."
}