⬢ DragonFlyBSD Kernel Audit
DF-4186 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4186",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "radeon_device_init() drops radeon_doorbell_init()s return value; when the CIK+ doorbell BAR2 ioremap fails (-ENOMEM), doorbell.ptr is NULL while num_doorbells>0, radeon_doorbell_get() then hands out valid indices and the first compute-ring WDOORBELL32 (cik.c:4207 via cik_compute_set_wptr during radeon_ib_ring_tests) writes to the NULL page: a load-time kernel panic on AMD CIK+ hardware under ioremap pressure or with a broken BAR2. Statically certain (path proven path:line), but the audit guest has no radeon GPU, so the path cannot execute there - status not_reproduced (device absent), impact ceiling is an availability crash (root/HW-conditional). Upstream Linux carries the same dropped check, so this is an inherited latent defect.",
  "exploit_chain": "",
  "evidence": "README.md path walk radeon_device.c:1422 -> :330-350 -> :374-384 -> cik.c:8662/8669 -> cik.c:4207; guest recon: no AMD PCI device in dmesg/pciconf (DF-4186/VERDICT.md)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_device.c:1422",
    "sys/dev/drm/radeon/radeon_device.c:330",
    "sys/dev/drm/radeon/radeon_device.c:374",
    "sys/dev/drm/radeon/cik.c:4207",
    "sys/dev/drm/radeon/cik.c:8662"
  ],
  "poc_changes": "no runnable PoC exists for this class on this guest (requires CIK+ radeon PCI hardware); static analysis pack only",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT x86_64 (QEMU 7.2, no radeon/AMD PCI devices present)",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "n/a (no hardware)",
  "run_cmd": "n/a (no hardware)",
  "code_hash": "",
  "notes": "upstream-inherited (torvalds/master radeon_device.c doorbell bar mapping block has the same dropped check); -EINVAL path (num_doorbells==0) aborts load cleanly because doorbell_get fails - only the ioremap-ENOMEM window reaches the NULL write",
  "recommended_fix": "check radeon_doorbell_init() return value and fail radeon_device_init (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is a one-line return-value check matching the sibling init calls in radeon_device_init; cannot be runtime-validated on this guest because no radeon hardware exists (device-absent), so fix validation is not_testable rather than fixed",
  "fix_evidence": "n/a - no radeon device on the audit guest",
  "fix_kernel_uname": ""
}