⬢ DragonFlyBSD Kernel Audit
DF-4288 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4288",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Three defects proven by code trace in the VRAM_Info -> MC-reg-table path of ppatomctrl.c: (1) vram_info from smu_atom_get_data_table is dereferenced at ppatomctrl.c:148 without a NULL check (helper returns NULL when the VBIOS master data table lacks VRAM_Info; the atom parser at amdgpu/atom.c:1384-1403 does no validation); (2) usMemClkPatchTblOffset (ppatomctrl.c:157) and usRegIndexTblSize (:55) are raw VBIOS USHORTs used as read offsets with no bound against the table size -> OOB read walk whose results are programmed into memory-controller registers; (3) atomctrl_retrieve_ac_timings walk (:60-86) advances by VBIOS-controlled usRegDataBlkSize with num_ranges only incrementing on tmem_id match, so usRegDataBlkSize==0 with a non-matching index is a non-preemptible infinite loop in the kldload/attach path (CWE-835), and a missing 0xFFFFFFFF sentinel walks past the BIOS image unbounded (CWE-125). Impact is boot/module-load kernel panic or hang under a crafted VBIOS \u2014 same threat model and Medium band as the known DF-1498. NOT runnable on this audit guest: it has no AMD dGPU (QEMU has no AMD GPU model; no drm module loads \u2014 env.txt), so the powerplay attach path cannot be entered; verification is by exhaustive trace (VERDICT.md). Destination arrays verified in-bounds, so no write primitive: mc_reg_address[32] indexed < 32 (ppatomctrl.h:251), mc_reg_table_entry[20] indexed < 20 (:250), mc_data[i-1] at i==0 aliases mclk_max in-struct (ppatomctrl.h:219-222).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-by-line trace); README.md (defect summary + trigger shapes); fix.diff (NULL check + offset bound + stride/table bound); env.txt (guest lacks AMD GPU)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:148",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:157",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:55",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:60",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:84",
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:660",
    "sys/dev/drm/amd/amdgpu/atom.c:1384"
  ],
  "poc_changes": "n/a \u2014 no PoC possible on this guest (no AMD dGPU); code-trace evidence pack instead",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "notes": "Hardware-absent case (same class as DF-1497/DF-1498 precedent rows): amdgpu cannot attach in QEMU, so the VRAM_Info readers are unreachable at runtime on this guest. Callers ci_smumgr.c:2708 / iceland_smumgr.c:2638 / tonga_smumgr.c:3120 run at SMU backend init (attach).",
  "recommended_fix": "NULL-check vram_info; validate usMemClkPatchTblOffset/usRegIndexTblSize/usRegDataBlkSize against the data-table size; reject usRegDataBlkSize < 4",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline behavior not reproducible on this guest (no AMD dGPU) -> no fixed-kernel build possible. fix.diff authored from trace.",
  "fix_evidence": "findings/poc/DF-4288/fix.diff (not applied to sys/; authored post-verification from line-accurate trace)"
}