⬢ DragonFlyBSD Kernel Audit
DF-4331 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-4331",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED: kernel Fatal trap 18 (integer divide fault, divq) inside the real mr_update_span_set (mrsas_fp.c:969) reached through the real MR_ValidateMapInfo call path when the firmware map carries quad.diff==0. On hardware this fires at adapter attach (mrsas.c:1762) or any AEN map sync (mrsas.c:2961) - a boot-persistent DoS from a buggy/malicious MegaRAID firmware. Two sibling unguarded fw divisors on the IO path (get_arm:599 and mr_spanset_get_phy_params:653-654 via spanRowSize==0) are fixed by the same validation.",
  "exploit_chain": "fw map with quad.diff=0 -> MR_ValidateMapInfo passes totalSize check -> mr_update_span_set mega_div64_32(...,0) -> #DE -> kernel panic in ddb, all CPUs stopped",
  "evidence": "panic.txt / run.log: Fatal trap 18: integer divide fault while in kernel mode + Stopped at probe_mr_update_span_set.part.0+0x1d7: divq %rcx,%eax; serial_decisive.log: full console record; DF-4330/fix_run.log: patched build rejects the same map with no panic",
  "kernel_refs": [
    "sys/dev/raid/mrsas/mrsas_fp.c:969",
    "sys/dev/raid/mrsas/mrsas_fp.c:599",
    "sys/dev/raid/mrsas/mrsas_fp.c:653",
    "sys/dev/raid/mrsas/mrsas_fp.c:390",
    "sys/dev/raid/mrsas/mrsas_fp.c:1431",
    "sys/dev/raid/mrsas/mrsas_fp.c:1359",
    "sys/dev/raid/mrsas/mrsas.c:1762",
    "sys/dev/raid/mrsas/mrsas.c:2961"
  ],
  "poc_changes": "same probe as DF-4330; mode 2 crafts quad[0].diff=0 with consistent totalSize so the map passes the drivers only check",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (guest, root) - shared with DF-4330",
  "run_cmd": "kldload /root/fp4330/fp_probe.ko; sysctl hw.fp_probe_run=2",
  "code_hash": "b30cab73ea2b04904c4c7393b68a37b526d79d065ae0ee3474aaf5f2829e2df7",
  "notes": "Guest was reset (vm.sh reset with-src) after the panic capture; final state clean. Fix validated with the patched-module probe (same file/flags/entry as in-kernel build): mode 2 rejected, no panic, benign maps unaffected.",
  "recommended_fix": "Reject maps with any live quad diff==0 or spanRowSize==0 on RAID 0/5/6 in MR_ValidateMapInfo (fix.diff, shared with DF-4330); alternatively mirror the existing MR_GetPhyParams zero guards at mrsas_fp.c:969/599/653",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched mrsas_fp.c rejects the diff=0 map at validation (returned 1, console message), no #DE, guest alive; benign map still accepted - regression-free",
  "fix_evidence": "DF-4330/fix_run.log: mode 2 block invalid RAID map geometry (ld/span/quad), rejecting map + MR_ValidateMapInfo returned 1 + guard integrity: 0/4096 with the guest remaining responsive (phases completed, kldunload succeeded)",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}