⬢ DragonFlyBSD Kernel Audit
DF-4308 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4308",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, hardware-gated. adwprocesserror() (adwcam.c:1341-1429) translates the device-written acb->queue.host_status byte but its switch omits four codes the drivers own firmware ABI defines (adwlib.h:346-354): QHSTA_M_DIRECTION_ERR 0x35, QHSTA_M_DIRECTION_ERR_HUNG 0x36, QHSTA_M_FROZEN_TIDQ 0x46, QHSTA_M_SGBACKUP_ERROR 0x47. Any completion carrying one of them falls into default: panic() at adwcam.c:1412-1414 -> kernel panic/DoS. 0x35/0x36 are data-phase-mismatch verdicts a misbehaving SCSI target can deliberately produce (phase violation), i.e. target-device-triggerable; 0x46/0x47 are U160-microcode statuses. Same device-fed-panic class as DF-1548/DF-2411/DF-2415 but reachable from ordinary I/O completion. No runtime reproduction: guest has no Advansys HBA (no vendor 10cd on pciconf).",
  "exploit_chain": "Attacker with an Advansys-equipped host plus a malicious/misbehaving SCSI target (or compromised HBA firmware): target violates the data phase for a command -> RISC completes it with host_status=0x35 -> adwprocesserror default branch -> panic(Unhandled Host status error 35) -> kernel DoS. Availability only.",
  "evidence": "findings/poc/DF-4308/VERDICT.md; switch adwcam.c:1350-1416; default panic adwcam.c:1412-1414; missing codes enumerated adwlib.h:346-354",
  "kernel_refs": [
    "sys/dev/disk/advansys/adwcam.c:1350",
    "sys/dev/disk/advansys/adwcam.c:1412",
    "sys/dev/disk/advansys/adwlib.h:346",
    "sys/dev/disk/advansys/adwlib.h:347",
    "sys/dev/disk/advansys/adwlib.h:353",
    "sys/dev/disk/advansys/adwlib.h:354"
  ],
  "poc_changes": "No seed PoC (finding new in pass 2). Hardware-gated; no executable PoC without an Advansys HBA and a phase-violating target.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 lens (d): error-recovery state machine completeness. Precedent severity for device-fed panic in this file: DF-2415 Medium / DF-1548 Low; rated Low because the trigger additionally requires target misbehavior.",
  "recommended_fix": "Handle 0x35/0x36/0x46/0x47 with CAM_DATA_RUN_ERR / CAM_REQUEUE_REQ mappings instead of panic() \u2014 see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (patch -p1 apply-verified); cannot be runtime-tested without Advansys hardware.",
  "fix_evidence": "findings/poc/DF-4308/fix.diff"
}