⬢ DragonFlyBSD Kernel Audit
DF-4318 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4318",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain: dce80/dce81/dce83_create_resource_pool (dce80_resource.c:1052-1067, 1262-1277, 1468-1483) never kfree(pool) when dceXX_construct() fails; constructs res_create_fail path runs destruct(pool) (frees sub-objects only) and the caller dc_construct (core/dc.c:671-677) cannot free a pointer it never received \u2014 sizeof(struct dce110_resource_pool) (~2KB) leaks per failed amdgpu bind on Sea Islands hardware (OOM in any sub-create, irq-service create failure, or resource_construct failure). Kernel-path reproduction untested: the audit guest has no AMD GPU (pciconf: virtio + generic VGA only; amdgpu.ko present but unbindable). A line-faithful control-flow model was built and run on the guest (cc 8.3) and confirms the orphaned allocation (run.log). Hardening-class leak, no privilege boundary crossed.",
  "exploit_chain": "",
  "evidence": "run.log / build_and_run.log (guest model run: LEAK CONFIRMED (model), failure path live_allocs=1 = orphaned pool); env.txt (no AMD GPU on guest); kernel refs dce80_resource.c:1056,1062,1066 + 1272-1276 + 1478-1482, destruct at :726-796, caller core/dc.c:671-677",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:1052",
    "sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:1062",
    "sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:1262",
    "sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:1468",
    "sys/dev/drm/amd/display/dc/core/dc.c:671"
  ],
  "poc_changes": "No seed PoC existed (pass-2 checklist hint only). Authored df4318.c: plain-C control-flow model of dce80_create_resource_pool/dce80_construct/destruct with explicit allocation accounting (host lacked a compiler; guest cc used; sanitizer-free so it runs anywhere).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o df4318 df4318.c",
  "run_cmd": "./df4318",
  "code_hash": "79b803e14c6924ae9781bf622f391745534e51d0ebf566e11efe6adc5a130040",
  "notes": "Trigger hardware absent on guest (no AMD dGPU; pciconf verified) \u2014 kernel-path test impossible on this platform. Same error-path shape exists in the dce100/110/112/120/dcn10 siblings but those are outside this files scope. Model proof ran on the guest itself; logs are full untrimmed output.",
  "recommended_fix": "Add kfree(pool) before return NULL in dce80/dce81/dce83_create_resource_pool failure paths (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the three missing kfree(pool) calls (mirroring dce80_destroy_resource_pool :841-848 destruct+free pattern). Cannot be kernel-validated on this guest (no AMD GPU); the model trivially shows the patched failure path ends at 0 live allocations.",
  "fix_evidence": "fix.diff; model accounting in df4318.c (pool_destroy() demonstrates the destruct+free pairing the fix restores on the failure arm)"
}