⬢ DragonFlyBSD Kernel Audit
DF-4227 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4227",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL-deref/UAF: after kldunload cyapa (or devctl detach) an open /dev/cyapa* fd dispatches into cyaparead/cyapawrite/cyapakqfilter which fetch the softc via devclass_get_softc (NULL after subr_bus.c:1164) and immediately lockmgr on it (cyapa.c:626) -> kernel panic; dispatch itself is through module ops freed by the unload. Not exercisable on the QEMU audit guest: no SMBus controller and cyapa children are only created for responding addresses (smbus.c:120-140), so the driver never attaches and /dev/cyapa* never exists - verified live (module builds, loads, sysctls register, no attach, clean unload; see run.log). Trigger on real hardware needs root for kldunload; severity Low (memory-corruption class, privileged trigger).",
  "exploit_chain": "root opens /dev/cyapa0-67 -> kldunload cyapa.ko -> read(fd) on inherited/held descriptor -> lockmgr(&sc->lk) with sc==NULL -> panic (deterministic); alternative post-unload dispatch through freed module ops memory is a control-flow candidate not demonstrated.",
  "evidence": "run.log (guest module lifecycle: load OK, no /dev/cyapa*, unload OK), run.2.log (trigger stops at open ENOENT), VERDICT.md (line-by-line chain), fix.diff (applies clean vs sys/)",
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:545",
    "sys/dev/smbus/cyapa/cyapa.c:616",
    "sys/dev/smbus/cyapa/cyapa.c:626",
    "sys/dev/smbus/cyapa/cyapa.c:749",
    "sys/dev/smbus/cyapa/cyapa.c:789",
    "sys/dev/smbus/cyapa/cyapa.c:1069",
    "sys/kern/subr_bus.c:1164",
    "sys/vfs/devfs/devfs_core.c:1546"
  ],
  "poc_changes": "n/a - pack authored fresh; trigger_detach_uaf.c written from scratch for this finding",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/dev/smbus/cyapa && make; cc -O2 -Wall -o trigger_detach_uaf trigger_detach_uaf.c",
  "run_cmd": "./trigger_detach_uaf (hardware) / module-lifecycle documentation (guest)",
  "code_hash": "73c05157751b11d4ce8ade78b38cfb03b50868c792ae7ad5ada3bc48ae2fcb53",
  "notes": "Hardware-gated (Cypress APA trackpad on SMBus 0x67). Guest proof of surface-absence captured in run.log. status untested = kernel-side reproduction impossible on this guest (not_testable vocabulary forbidden this run).",
  "recommended_fix": "cyapa_detach: return EBUSY while sc->count != 0, wakeup(&sc->blocked); add NULL sc checks to cyaparead/cyapawrite/cyapakqfilter (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation requires the cyapa device to attach (detach/read paths unreachable in QEMU); fix.diff is line-accurate against the verified root cause and applies cleanly to sys/.",
  "fix_evidence": "findings/poc/DF-4227/fix.diff (git apply --check clean)"
}