⬢ DragonFlyBSD Kernel Audit
DF-4317 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4317",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Hardware-gated: the audit guest has no Level-One LXT1001 NIC (ifconfig -l -> vtnet0 lo0), so no runtime PoC is possible -> untested. Source analysis is certain: lge_jref() (sys/dev/netif/lge/if_lge.c:801-814) performs an unlocked check-then-increment (inuse!=0 read at :810, atomic_add at :813) while lge_jfree() (:819-841) decrements and recycles the slot onto lge_jfree_listhead under sc->lge_jslot_serializer (:833-837). A racing jref/jfree interleaving puts a slot on the free list with inuse==1; lge_jalloc() (:777-794, serialized) then hands the same 9KB jumbo cluster to a new RX descriptor while a shared mbuf still references it: NIC DMA into a live stack buffer (cross-packet data bleed), and the later second free either panics (lge_jfree: buffer already free! :831) or double-inserts the slot, corrupting the freelist. Byte-for-byte the same defect as DF-1384 (nge_jref, sys/dev/netif/nge/if_nge.c) in lges copy of the Bill Paul jumbo-pool template; only lge_jref is the unlocked actor (lge_jalloc/lge_jfree are correctly serialized). ext_ref reachability: wired for every RX jumbo mbuf at :685-688; the mbuf layer calls it on m_copym full-buffer copies / m_dup_pkthdr / BPF copies. Requires >=2 CPUs, RX traffic, and a cluster share+free race -> Low severity local DoS / data-corruption ceiling.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4317/VERDICT.md (interleaving diagram + path:line proof); findings/poc/DF-4317/fix.diff (serialized check+increment, mirrors the DF-1384 fix); twin precedent DF-1384 row in audit.db",
  "kernel_refs": [
    "sys/dev/netif/lge/if_lge.c:685",
    "sys/dev/netif/lge/if_lge.c:801",
    "sys/dev/netif/lge/if_lge.c:810",
    "sys/dev/netif/lge/if_lge.c:813",
    "sys/dev/netif/lge/if_lge.c:819",
    "sys/dev/netif/lge/if_lge.c:833",
    "sys/dev/netif/lge/if_lge.c:836",
    "sys/dev/netif/lge/if_lge.c:777"
  ],
  "poc_changes": "No seed PoC. Hardware-gated analysis pack: no LGE NIC exists in the QEMU guest, so verification is by source-path inspection against the DF-1384 twin whose class was already established.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Only remaining unlocked actor in the lge jumbo pool. Fix is one lock acquire/release pair; validated by inspection (no recursion: lge_jref runs from mbuf code with no driver locks held).",
  "recommended_fix": "Take sc->lge_jslot_serializer around the check+increment in lge_jref() (findings/poc/DF-4317/fix.diff), mirroring the DF-1384 nge fix.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (applies cleanly to sys/dev/netif/lge/if_lge.c); cannot be validated without lge hardware.",
  "fix_evidence": "findings/poc/DF-4317/fix.diff"
}