{ "finding_id": "DF-4167", "status": "reproduced", "reproduced": true, "impact": "dos", "confidence": "certain", "verdict": "REPRODUCED via the verbatim-code rig: get_firmware_info_v3_2 (bios_parser2.c:1204-1280), its dispatcher bios_parser_get_firmware_info (:1119-1155), the v3_1 control (:1157-1202), bios_get_image (bios_parser_helper.c:36-44) AND the full production PLL sink chain from dce_clock_source.c (calc_pll_max_vco_construct :1142-1218, calculate_pixel_clock_pll_dividers :287-388, calc_pll_dividers_in_range :245-285, calc_fb_divider_checking_tolerance :189-243, calculate_fb_and_fractional_fb_divider :130-170) were sed-extracted byte-identical from sys/ (34 blocks re-verified identical ON THE GUEST against /usr/src/sys, the tree its running kernel was built from; the checker also proves the APPLY_DF4167_FIX build is exactly fix.diff applied to the production function). Crafted ATOM image with firmwareinfo v3.2 + dce_refclk_10khz=0. Baseline production code: (a) smu_info table MISSING -> GET_IMAGE(..,0) returns the image base, its bytes are mis-parsed as the table header (major=bios[2]&0x3f=16, minor=bios[3]&0x3f=32), fallback skipped -> BP_RESULT_OK with pll_info.crystal_frequency=0; (b) smu_info present with revision.minor=1 -> same OK+0. Controls: smu rev 2->27000, rev 3->100000, v3.1+zero refclk->27000 UNCONDITIONALLY (:1187-1188), isolating v3_2 as the gap. Sink: feeding the parser result through the verbatim clock-source chain, the SS/DP mode-set path (VBIOS AdjustPixelClock fills reference_divider AND pix_clk_post_divider, dce_clock_source.c:447-450) reaches calculate_fb_and_fractional_fb_divider and dies of SIGFPE/FPE_INTDIV with RIP inside that function -- the only zero divisor on the path is ref_freq_khz at dce_clock_source.c:145 div_u64(feedback_divider, ref_freq_khz) (kernel equivalent: #DE panic at first mode set). Without the post-divider preset, v3_2s zero-filled pll_info trips the graceful Post divider range is invalid exit first; without any VBIOS-adjusted divider the plain path 0/0s at :336-337 (ref_freq/max_pll_input, divisor zero from the separately pre-existing unfilled-pll_info issue that affects v3_1 equally -- still faults in the fixed build; recorded as incidental, not this findings gap). In-kernel fault-path reachability traced: calc_pll_max_vco_construct is called only by dce110_clk_src_construct (dce80/dce100/dce110 clock sources), and dal_bios_parser_create tries bios_parser2 FIRST for every ASIC with purely table-revision-driven dispatch, so a crafted new-format ROM on those ASICs hits v3_2 -> #DE; genuine DCE11x/DCE12/DCN10 clock sources (dce112_clk_src_construct) never run the calc-PLL math and only misconfigure I2C/ref-clock consumers (dce_i2c_hw.c:108, dc_resource.c:162) -- the findings middle-hop citation (dce112 construct calling calc_pll_max_vco_construct) does not hold in this tree, the dce110-family construct does. Gating: AMD ASIC + crafted/corrupted VBIOS (flashed ROM, vfio romfile, malicious device); no unprivileged userland trigger; guest has no AMD GPU (Bochs 0x1234:1111, no dev.drm, no amdgpu - env.txt), so the guest kernel never executes the path. fix.diff (require smu_info presence + NULL header check + unconditional 27000/100000 fallback) A/B-validated in the same rig on identical images: missing table -> BP_RESULT_BADBIOSTABLE, rev-1 table -> 27000, full PLL math completes (feedback_divider=11, vco=307998) with no fault.", "exploit_chain": "Hardware/firmware attacker model only: craft VBIOS with firmwareinfo v3.2/v3.3 (content_revision 2/3) and dce_refclk_10khz=0 plus a missing or non-2/3 smu_info revision -> amdgpu attach -> dal_bios_parser_create -> bios_parser2 get_firmware_info_v3_2 returns OK with crystal_frequency=0 -> calc_pll_max_vco_construct stores ref_freq_khz=0 (dce_clock_source.c:1159) -> first mode set with VBIOS-adjusted dividers (SS/DP) -> div_u64(feedback_divider, 0) at :145 -> #DE kernel panic (DoS). No uid0 potential (crash-only primitive).", "evidence": "run.log / run.2.log (all modes baseline vs fixed, stable across two runs), fix_validation.log (A/B extract), build.log (34x identical to production incl. guest /usr/src/sys + fix-variant==patch-application proof + zero-warning builds), VERDICT.md (full narrative incl. sink-reachability trace and limitations), rig/ (sources), env.txt (hardware gating), code_hashes.txt", "kernel_refs": [ "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1229", "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1257", "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1259", "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1187", "sys/dev/drm/amd/display/dc/dce/dce_clock_source.c:1159", "sys/dev/drm/amd/display/dc/dce/dce_clock_source.c:145", "sys/dev/drm/amd/display/dc/dce/dce_clock_source.c:336", "sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c:40", "sys/dev/drm/amd/display/dc/bios/bios_parser_interface.c:41" ], "poc_changes": "Seed pack had no runnable PoC (status untested, hardware-gated). Built the verbatim rig from scratch: gen_rig.sh extracts the production parser slice AND the dce_clock_source.c PLL sink chain byte-identical (both sides of the finding); check_verbatim.sh proves block identity (host tree AND guest /usr/src/sys) and -- new vs the DF-4165 checker -- reconstructs the fixed function by applying fix.diff to the production text and proves the APPLY_DF4167_FIX variant equals it; harness drives parser modes (missing/rev1/rev2/rev3/v3.1) and three sink modes with SIGFPE site classification (function-range + only-zero-divisor analysis). Fixed two harness offset bugs found during the run (smu bootup_dcefclk and dce_refclk field offsets now via offsetof on the verbatim structs) and added fflush before child _exit so fixed-build child output is captured.", "attempts": 3, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 1500, "guest_dirty": 0, "build_cmd": "cd /home/maxx/DF-4167/rig && sh ./build.sh /usr/src", "run_cmd": "cd /home/maxx/DF-4167/rig && sh ./run.sh", "code_hash": "fw_slice_verbatim.c 2a5c8f281a9f069cc0d9049f46110af96a9e5bec9c12f7cf3683e08c2193584b; fw_slice_verbatim.h 02a77c083145300aa4d8f88b62f17afdf96113ca15357b65fd45729d9e9d5944; fw_rig.c 0523003091f7946b734243e9482c0b2aec7245d7537f3299fbd8f1a437c52825 (full list in code_hashes.txt)", "notes": "Impact dos = crash-class floor (#DE panic) of the demonstrated primitive; no uid0 potential (divide-by-zero only). Deterministic across run.log and run.2.log. Incidental observations recorded for triage, NOT new findings: (1) v3_x never fills pll_info input/output frequency fields, so v3_2-with-crafted-ROM on a calc-PLL ASIC 0/0s at dce_clock_source.c:336 even with the crystal backfilled (pre-existing, affects v3_1 equally; fixed build still faults in sink-plain mode); (2) the filed summarys missing-table byte arithmetic (minor=0x2A from 0x55 0xAA) mis-identifies which image byte lands in content_revision -- minor comes from image byte 3 since bytes 0-1 are the u16 structuresize -- substance unchanged; (3) the findings intermediate chain (dce120->dce112_clk_src_construct->calc_pll_max_vco_construct) does not hold in this tree: dce112_clk_src_construct (:1323) never calls calc_pll_max_vco_construct; the sink is reachable via dce110_clk_src_construct (:1220) on dce80/dce100/dce110, where bios_parser2 is still tried first by dal_bios_parser_create. Guest left up and clean (only /home/maxx/DF-4167 scratch; no kernel or system state changed).", "recommended_fix": "Require the smu_info table (presence + header NULL check) and make the crystal_frequency fallback unconditional (27000, 100000 for smu rev 3) - fix.diff, A/B validated in the rig.", "fix_status": "fixed", "fix_baseline_reproduced": true, "fix_patched_reproduced": false, "fix_verdict": "A/B validated in the verbatim rig: identical crafted images, same slice, only fix.diff under -DAPPLY_DF4167_FIX (checker-proven equal to the patch applied to the production function). Baseline: OK+zero clock on both triggers; SIGFPE at dce_clock_source.c:145 (SS/DP path). Fixed: missing smu_info -> BP_RESULT_BADBIOSTABLE (clock-source construction fails cleanly via calc_pll_max_vco_constructs != BP_RESULT_OK check); rev-1 smu_info -> 27000; full PLL divider search completes with no fault. The separate :336 0/0 (unfilled pll_info input freqs, v3_1-equivalent) is out of scope for this fix and still faults in sink-plain mode with 27000/0. Kernel-rebuild validation not performed: the fix site executes in-kernel only on AMD ASICs absent from this guest; per the verbatim-rig protocol the fixed slice was validated in the same rig. fix.diff authored against the pristine read-only sys/ tree, never applied there.", "fix_evidence": "fix_validation.log (baseline vs fixed A/B extract); run.log FIXED sections; build.log (APPLY_DF4167_FIX variant == fix.diff applied to bios_parser2.c:1204-1280); fix.diff" }