⬢ DragonFlyBSD Kernel Audit
DF-4315 / trigger.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-4315 — trigger / environment probe.
#
# The bug is in the ath(4) RX path (kernel, device-fed data); there is no
# userspace-only trigger.  Firing it requires:
#   - an Atheros NIC (AR5210..AR9580 family) on the DragonFly host,
#   - a monitor-mode VAP (ifconfig wlan0 create wlandev ath0 wlanmode monitor)
#     with a BPF listener (tcpdump -i wlan0) to observe the radiotap bytes,
#   - over-the-air frames whose hardware rate code is NOT in the currently
#     loaded mode's rate table (e.g. XR-coded frames on AR5212, or MCS rates
#     above the loaded table's chain count in monitor mode on 11n parts).
#
# On the audit guest we can only (honestly) verify the precondition: the
# absence of any ath device.
echo "--- DF-4315 precondition check ---"
ifconfig -l
pciconf -l 2>/dev/null | grep -i 168c || echo "no Atheros PCI device (vendor 0x168c)"