⬢ DragonFlyBSD Kernel Audit
DF-4230 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "finding_id": "DF-4230",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "summary": "cyapa_poll_thread declares struct cyapa_regs regs uninitialized (cyapa.c:1164); smbus failure leaves it untouched, but the reset decision at cyapa.c:1191-1193 reads regs.stat regardless - an uninitialized stack byte decides whether init_device() bootloader handshakes are re-issued every 3s. Logic/robustness defect, no leak, no memory unsafety.",
  "reproduce": {
    "build": "cc -O0 -Wall -o model_uninit_regs model_uninit_regs.c",
    "run": "./model_uninit_regs 0x2d ; ./model_uninit_regs 0xcd",
    "expected": "re-init decision flips purely on the uninitialized byte (reinited=1 for 0x2d, reinited=0 for 0xcd)"
  },
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:1164",
    "sys/dev/smbus/cyapa/cyapa.c:1178",
    "sys/dev/smbus/cyapa/cyapa.c:1191",
    "sys/dev/smbus/cyapa/cyapa.c:1196"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "model_uninit_regs.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}