⬢ DragonFlyBSD Kernel Audit
DF-4217 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4217",
  "verdict": "Source-certain, runtime hardware-gated (inconclusive per family convention). ae_stop_rxmac() (sys/dev/netif/ae/if_ae.c:288) and ae_stop_txmac() (:324) both wait for the device idle state with `for (i = 0; i < AE_IDLE_TIMEOUT; i--)` — the loop counter is DECREMENTED, so the guard (i<100, AE_IDLE_TIMEOUT=100, if_aevar.h:41) is permanently true: unless the device happens to report idle, the loop busy-waits in DELAY(100) forever holding ifp->if_serializer, and the post-loop timeout message (:294/:330, `if (i == AE_IDLE_TIMEOUT)`) is unreachable because i can never rise to 100. The correct sibling loops ae_stop():255 and ae_reset():1510 use i++. A surprise-removed/halted/errored device (MMIO reads 0xFFFFFFFF, IDLE bits set) or a malicious passthrough NIC feeding permanent non-idle wedges every stop path: ifconfig down (:1220-1221), ae_init (:799, also from ae_intr :770-775 in interrupt context), watchdog (:983), detach (:1417), suspend (:1786), shutdown (:1801), miibus statchg (:366-367). Termination model built and run on the audit guest (stoploop.c, run.log RC=0): as-written shape runs unbounded (model self-capped at 10M iterations, i=-9999999, timeout branch never taken); fixed i++ variant exits after exactly 100 reads. End-to-end hardware trigger gated (no 1969:2048 device on guest; if_ae not in X86_64_GENERIC; guest /usr/src md5 429ba8f801876d3e7a39eca15612f3ed == audited tree). DoS only, no memory corruption, no privilege path.",
  "impact": "none",
  "reproduce": {
    "build": "scp -F dfbsd-qemu/config findings/poc/DF-4217/stoploop.c dfbsd:/tmp/ ; vm.sh run_root 'cc -O2 -Wall -Wextra -o /tmp/df4217 /tmp/stoploop.c && echo BUILD_4217_OK'",
    "run": "vm.sh run_root '/tmp/df4217; echo RC_4217=$?'",
    "expected": "[1] MODEL SELF-CAP HIT after 10,000,000 iterations, guard permanently true, timeout branch NOT taken (i=-9999999); [2] fixed i++ exits after exactly 100 reads; RC_4217=0"
  },
  "kernel_refs": [
    "sys/dev/netif/ae/if_ae.c:288",
    "sys/dev/netif/ae/if_ae.c:324",
    "sys/dev/netif/ae/if_ae.c:255",
    "sys/dev/netif/ae/if_ae.c:294",
    "sys/dev/netif/ae/if_ae.c:330",
    "sys/dev/netif/ae/if_ae.c:1510",
    "sys/dev/netif/ae/if_aevar.h:41",
    "sys/dev/netif/ae/if_ae.c:799",
    "sys/dev/netif/ae/if_ae.c:770",
    "sys/dev/netif/ae/if_ae.c:1221",
    "sys/dev/netif/ae/if_ae.c:1417",
    "sys/dev/netif/ae/if_ae.c:1786",
    "sys/dev/netif/ae/if_ae.c:366"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "stoploop.c",
    "build.sh",
    "run.sh",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}