⬢ DragonFlyBSD Kernel Audit
DF-4222 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4222",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL dereference: pvscsi_action(XPT_ABORT) at pvscsi.c:1395-1397 reads abort_hcb->ccb where abort_hcb = abort_ccb->ccb_h.ccb_pvscsi_hcb, a back-pointer the driver itself sets to NULL on every completion (pvscsi.c:1018) and that is NULL for CCBs never issued through this SIM. Aborting a completed/never-issued CCB \u2014 reachable in-tree through targ(4) abort paths that race a concurrent completion (scsi_target.c:498-500,1099-1103 run under crit_enter() only, completion clears the pointer on another CPU under sc->lock) \u2014 faults at a small fixed offset from NULL => panic. The driver already NULL-checks the identical pointer in its timeout handler (pvscsi.c:850-853), proving the intended protocol; every other checked SIM in the tree validates before dereference. Not live-reproducible on the audit guest (QEMU exposes no pvscsi device) so impact recorded as none; realistic ceiling is a privileged/racy local DoS on VMware guests.",
  "exploit_chain": "",
  "evidence": "VERDICT.md: pvscsi.c:1397 first-operand deref vs pvscsi.c:1018 NULL-clear vs pvscsi.c:850-853 guarded timeout path; scsi_target.c:498-500 crit_enter-only abort loop racing pvscsi.c:1018. patch_apply.log + build.log: one-line fix applies and compiles on the pristine guest kernel source.",
  "kernel_refs": [
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:1389-1411",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:1395-1397",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:1018-1019",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:850-853",
    "sys/dev/virtual/vmware/pvscsi/pvscsi.c:1200-1212",
    "sys/bus/cam/scsi/scsi_target.c:498-500",
    "sys/bus/cam/scsi/scsi_target.c:1099-1103",
    "sys/dev/virtual/virtio/scsi/virtio_scsi.c:941-974"
  ],
  "poc_changes": "no PoC source \u2014 device-gated; evidence is the source trace plus on-guest fix build validation",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys && patch -p2 < fix.diff && cd /usr/src/sys/dev/virtual/vmware/pvscsi && make",
  "run_cmd": "(none \u2014 HW/vmm-gated; see run.sh)",
  "code_hash": "3a1141c743fdc202e5e4fd4da54477e15562e19432430c92b9ca2167efac2b57",
  "notes": "code_hash is sha256 of fix.diff. Guest kernel source restored to pristine after validation. Note the adjacent inconsistency: pvscsi error paths (1200-1212, 1329-1341) xpt_done CCBs without clearing ccb_pvscsi_hcb, leaving stale back-pointers; harmless for the abort handler today but should be cleared for symmetry.",
  "recommended_fix": "Change the XPT_ABORT guard to if (abort_hcb != NULL && abort_hcb->ccb == abort_ccb) and clear ccb_pvscsi_hcb in the execute_ccb/finish_ccb error paths",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line NULL-check fix applies cleanly to the pristine guest kernel source (patch_apply.log) and the pvscsi module compiles (build.log). Runtime validation HW-gated on this guest.",
  "fix_evidence": "patch_apply.log (clean apply), build.log (module rebuild OK)"
}