⬢ DragonFlyBSD Kernel Audit
DF-4312 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4312",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect is certain: dcn10_resource.c:744-746 indexes the 4-entry const tables link_enc_regs/link_enc_aux_regs/link_enc_hpd_regs with transmitter (producible values -1 and 4..9 via dc_link.c translate_encoder_to_transmitter incl. TRANSMITTER_UNKNOWN=-1 and legitimate UNIPHY_E/F/G + external TRAVIS/NUTMEG encoders), channel-1 (producible -1 via CHANNEL_ID_UNKNOWN and 4..7 via DDC5/6/VGA/I2C_PAD) and hpd_source (producible 4..6 incl. HPD_SOURCEID_UNKNOWN=6) - all from the GPUs VBIOS object tables with no validation; the OOB const-array reads become the encoders MMIO register bases (wild MMIO, minimum a bring-up hang, no userspace-readable leak). Could NOT be executed on the audit guest: pciconf shows zero AMD/ATI devices, so dcn10_create_resource_pool is unreachable at runtime. Same trust boundary and severity as DF-4216 (Low, crafted/foreign VBIOS required). fix.diff adds a bounds check returning NULL, which dc_link.c:1186-1190 already handles gracefully; git apply --check clean.",
  "exploit_chain": "supply/flash a crafted or foreign VBIOS on a Raven-class DCN1 APU whose display object table declares e.g. an EXTERNAL_TRAVIS encoder, a DDC5/VGA DDC line, or HPD_SOURCEID5/6 for a connector -> amdgpu attach -> dc_link_construct -> dcn10_link_encoder_create performs the OOB const reads -> stored bogus register bases -> subsequent link-encoder register programming issues MMIO at VBIOS-chosen offsets (hang/machine-check/wrong-hardware pokes). Requires physical/firmware control of the GPU; no unprivileged or remote path.",
  "evidence": "VERDICT.md (line-accurate index-domain proof), README.md (value-domain table), env.txt (guest hardware absence: amd-gpu-count=0), fix.diff (bounds check, git-apply clean)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:744",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:745",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:746",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:1177",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:1008",
    "sys/dev/drm/amd/display/include/grph_object_defs.h:81"
  ],
  "poc_changes": "No executable PoC authored: the trigger requires DCN1 silicon + crafted VBIOS which the audit guest cannot provide; the evidence pack documents the static proof instead.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Checked guest hardware explicitly (pciconf: no AMD/ATI device) before classifying. Twin of DF-4216 trust domain (VBIOS-derived index), rated Low there and here. All other dcn10_resource.c register-table lookups (tg_regs/hubp_regs/tf_regs/opp_regs/ipp_regs/aux_engine_regs/i2c_hw_regs/audio_regs/clk_src_regs) use compile-time or res_cap-bounded indices and were verified in-bounds.",
  "recommended_fix": "Bounds-check transmitter/channel/hpd_source against ARRAY_SIZE of the three register tables in dcn10_link_encoder_create and return NULL on violation (see fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_applicable: no DCN1 hardware available to run a baseline or patched test; fix verified by inspection and git apply --check against sys/.",
  "fix_evidence": "findings/poc/DF-4312/fix.diff"
}