⬢ DragonFlyBSD Kernel Audit
DF-4169 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-4169",
  "status": "reproduced",
  "reproduced": true,
  "verdict": "Every defect the finding enumerates was demonstrated in byte-identical production smu8_hwmgr.c code on the DragonFly guest (verbatim-rig evidence class; in-kernel execution is AMD-ASIC-gated, no AMD GPU in the guest). The findings exact NULL+0x30 write was reproduced: with a VBIOS power table lacking any Boot-classified state, psm_init_power_table (pp_psm.c:53-94) leaves hwmgr->request_ps/current_ps kzalloc-zeroed (magic=0), cast_smu8_power_state returns NULL, and smu8_apply_state_adjust_rules:1051 executes smu8_ps->need_dfs_bypass = true as a kernel NULL-page WRITE at exactly offset 0x30 (fault classifier: SIGSEGV addr=0x30 WRITE) -- in-kernel a fatal trap/panic. Sibling sites confirmed the same way: NULL+0x4 and NULL+0x44 reads in smu8_dpm_get_sclk (:1321/:1319), the literal levels[0xFFFFFFFF] wild reads ~64GB out (:1321, :1601) when a magic-valid state has level==0, and the smu8_get_performance_level clamp defeat (:1571: index > 0xFFFFFFFF is never true, so index passes unclamped) reading 324B past the 320B state allocation (:1572). A Boot-flag control run isolates the precondition exactly, and the packs fix.diff was A/B-validated in the same rig: all guarded modes return -EINVAL without faulting, clean-valid output byte-identical, and the DF-4171 modes keep faulting under it (orthogonality proof). Three runs byte-identical.",
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "crafted/corrupted VBIOS (flashed ROM or vfio-pci romfile) on a Carrizo/Bristol Ridge SMU8 APU -> amdgpu attach -> pptable parse produces no Boot-classified state -> psm_init_power_table leaves request_ps/current_ps zeroed -> driver init completes -> first runtime power-state transition (smu8_apply_state_adjust_rules) or sysfs clock query (smu8_dpm_get_sclk) dereferences the NULL cast -> kernel-mode fault on the unmapped null page -> panic (local DoS). level==0 states additionally give ~64GB wild reads and clamp-defeat OOB reads past the state allocation. No unprivileged userland trigger on stock hardware; no content control beyond the fault.",
  "evidence": "findings/poc/DF-4169/run.log: [BASELINE] MODE 4169-null-adjust-rules -> !! SIGSEGV (addr=0x30, WRITE) => NULL DEREF: WRITE at NULL+0x30; MODE 4169-level0-get-sclk -> fault 68719476900 bytes from the state base (~64GB): WILD levels[0xFFFFFFFF]-STYLE READ; MODE 4169-level0-perf-unclamped -> fault 324 bytes PAST THE END of the 320B object; [FIXED] sections show rc=-22/no fault for every 4169 mode; build.log: 26 verbatim blocks ALL PASSED on the guest against /usr/src; run.2/run.3.log md5-identical",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:51",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:59",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1041",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1051",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1066",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1316",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1319",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1321",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1569",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1571",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1601",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:53",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:90"
  ],
  "poc_changes": "Seed pack had no runnable PoC (not runnable here). Built the verbatim rig per the DF-4388 pattern: gen_rig.sh/check_verbatim.sh extract and guest-verify 26 byte-identical blocks (10 function slices incl. all four cited cast sites + their verbatim callees, 16 header slices); rig_shims.h minimizes pp_hwmgr/dyn_state/smu8_hwmgr with production field names/types, recording shims for the three off-defect-path SMU helpers, guard-backed kzalloc shims (end-anchored + lead-guard); smu8_rig.c drives 11 modes with a read/write-classifying fault handler (DragonFly mc_err). Fixed build applies the packs fix.diff to a pristine copy (header-normalized, hunk bodies cmp-identical) and re-extracts the patched functions; both directions patch-proven.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1,
  "guest_dirty": 0,
  "build_cmd": "cd rig && sh build.sh /usr/src  (guest: /root/pack4169/rig)",
  "run_cmd": "cd rig && sh run.sh  (guest: /root/pack4169/rig)",
  "code_hash": "aa27837d55a922b1b0cfc10810471ce2bbb6158d7fce9bcb9ba0d2a75f5a61b5",
  "notes": "Struct offsets measured, not assumed: need_dfs_bypass at 0x30 (the filed offset, exact), action 0x40, levels 68, level 16B -> levels[0xFFFFFFFF] = state+0x1000000034 (64.0GB), printed in layout mode and matched by the faulting addresses. The finding summary attributes the 0xFFFFFFFF underflow to get_performance_level; measured, :1571 there manifests as clamp-defeat (unclamped levels[index] OOB read), while the literal levels[level-1] wrap occurs at :1321/:1600-1601 -- both demonstrated, both covered by the fixs level==0 guards. get_sclk returns uint32_t so the fixed builds -EINVAL surfaces as 4294967274 (production return-type quirk). Guest /usr/src verified pristine (md5 a0cb59b723434a78e88bf0580d5a5508) before and after; guest left up and clean.",
  "recommended_fix": "NULL-guard the four unchecked cast sites and bail on level==0: apply fix.diff (return -EINVAL when smu8_ps/smu8_current_ps/ps is NULL or ps->level==0 in smu8_apply_state_adjust_rules, smu8_dpm_get_sclk, smu8_get_performance_level, smu8_get_current_shallow_sleep_clocks).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "A/B validated in the same rig: rig_fixed = same verbatim slice + this packs fix.diff (forward apply with --fuzz=0, no rejects; reverse apply restores the pristine file byte-exactly; hunk bodies cmp-identical to the packs fix.diff). On identical inputs every demonstrated 4169 mode is neutralized (rc=-EINVAL, no fault, no NULL write, no wild read, no OOB read) while clean-valid output stays byte-identical to baseline; the DF-4171 modes still fault under this fix, proving orthogonality (they are a different finding). Rebuilt-kernel validation not performed: the fix sites execute in-kernel only on AMD ASICs absent from this guest (verbatim-rig protocol, DF-4165/4247/4388/4396).",
  "fix_evidence": "run.log FIXED sections: 4169-null-adjust-rules rc=-22 ... returned WITHOUT faulting (guard active in fixed build); 4169-level0-perf-unclamped rc=-22 coreClock=0; clean-valid lines identical to baseline; check output in build.log: ALL VERBATIM CHECKS PASSED incl. smu8_slice_fixed.inc == pristine file + fix.diff (function blocks) and reverse-applying fix.diff restores the pristine file byte-exactly"
}