⬢ DragonFlyBSD Kernel Audit
DF-4221 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4221",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL-dereference: pvscsi_process_completion (pvscsi.c:899-909) resolves the device-fed completion context to an hcb and writes ccb->csio.scsi_status without checking hcb->ccb for NULL, although hcb->ccb is NULL for every not-in-flight hcb (pvscsi_hcb_put pvscsi.c:382) and the drivers own timeout handler guards this exact case (pvscsi.c:850-853). A duplicate completion for an already-completed context, or a spurious completion for a never-issued in-range context, both device(hypervisor)-fed via the shared completion ring, drive a write to a fixed low address => kernel panic. Distinct from DF-1455 (out-of-range context => wild hcb pointer): here the context is in-range and the hcb valid; only the ccb==NULL check is missing. Not live-reproducible on the audit guest (QEMU exposes no pvscsi device; no 15ad PCI ids), so impact recorded as none; realistic impact is a hypervisor/host-triggered denial of service on VMware guests.",
  "exploit_chain": "",
  "evidence": "VERDICT.md trace: pvscsi.c:903 (ccb = hcb->ccb) -> pvscsi.c:908 (ccb->csio.scsi_status = sdstat with ccb==NULL), contrast with the guarded timeout path pvscsi.c:850-853. fix.diff applies to pristine guest source (patch_apply.log), module rebuilds (build.log) and the guards string completion for idle context %llu ignored is present in the built pvscsi.ko.",
  "kernel_refs": [
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:888-909",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:903",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:908",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:850-853",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:377-386",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:1018-1020",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:1051-1058"
  ],
  "poc_changes": "no PoC source \u2014 device(hypervisor)-gated; evidence is the source trace plus on-guest fix build validation",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys && patch -p2 < fix.diff && cd /usr/src/sys/dev/virtual/vmware/pvscsi && make",
  "run_cmd": "(none \u2014 HW/vmm-gated; see run.sh)",
  "code_hash": "d7bad989970c704d4306b7bb9193209fb1a0280510f5a5e9bf7e139da085ad59",
  "notes": "code_hash is sha256 of fix.diff (no runnable PoC). Guest kernel source restored to pristine after validation (md5 d3cfdba6fe7b03d200afcfaec291f544). Same trust boundary as DF-1454/DF-1455 but a distinct missing check; fix is complementary to DF-1455s in-range context validation.",
  "recommended_fix": "In pvscsi_process_completion, after ccb = hcb->ccb, return early (with a device_printf) when ccb == NULL, mirroring the guard already present in pvscsi_timeout",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applies cleanly to the pristine guest kernel source (patch_apply.log) and the pvscsi module compiles with the guard (build.log; guard string verified inside the built pvscsi.ko). Runtime behaviour is hardware(vmm)-gated on this guest \u2014 no pvscsi device \u2014 so the fix is compile-validated only.",
  "fix_evidence": "patch_apply.log (clean apply), build.log (module rebuild OK), strings pvscsi.ko | grep idle context => completion for idle context %llu ignored"
}