⬢ DragonFlyBSD Kernel Audit
DF-4234 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4234",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain Low: txp_alloc_rings() kmallocs 256 persistent swdescs whose only references live inside the DMA-shared sc_ldata block (if_txp.c:948-956); when the function later fails (fw boot-record handshake, :972-991), txp_attachs fail path runs txp_release_resources() (:326-328 -> :358-374) which frees irq/res/ldata but not the swdescs -> 4096 bytes leaked per failed attach on a half-broken card; secondary: the post-ifmedia_init bus_setup_intr failure path (:315-322) skips ifmedia_removeall(). Untested (Low, hardware-gated error path; no PoC per contract -- guest has no 3c990, run.log shared with DF-4231).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (error-path trace), fix.diff (leak fix incl. detach-loop dedup to avoid double-free), run.log (driver in kernel, NO_3COM_PCI_DEVICE)",
  "kernel_refs": [
    "sys/dev/netif/txp/if_txp.c:948",
    "sys/dev/netif/txp/if_txp.c:952",
    "sys/dev/netif/txp/if_txp.c:972",
    "sys/dev/netif/txp/if_txp.c:326",
    "sys/dev/netif/txp/if_txp.c:358",
    "sys/dev/netif/txp/if_txp.c:370",
    "sys/dev/netif/txp/if_txp.c:315",
    "sys/dev/netif/txp/if_txp.c:349"
  ],
  "poc_changes": "n/a -- Low finding, PoC skipped per contract (verdict status untested).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "401b7281028566ee173bb088da870b02a83adc82b3f51b8adf59902b1918d135",
  "notes": "fix.diff moves the swdesc free into txp_release_resources under a sc_rxbufs NULL-guard and REMOVES txp_detachs own loop (:349-350) to avoid introducing a double-free; also drops the now-unused int i there.",
  "recommended_fix": "Free rb_sd in txp_release_resources before contigfree of sc_ldata; ifmedia_removeall on the late attach-failure path (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Low-severity leak fix; not runtime-validable (hardware-gated error path). Diff is build-safe and dedups the detach free.",
  "fix_evidence": "fix.diff"
}