⬢ DragonFlyBSD Kernel Audit
DF-4332 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4332",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "INCONCLUSIVE - hardware absent. The unlocked-walk defect is established by inspection: ioctl.c:316-329 dispatches the entire read-only GUI ioctl family to hpt_default_ioctl with no driver lock and ioctl.c:219-263 (DELETE_ARRAY) frees array/member tables equally unlocked, while gui_lib.c (self-declared unsynchronized, header lines 36-37) dereferences pMember[]/pParent chains in get_array_flag/calc_rebuild_progress/get_array_info/hpt_get_logical_devices. Concurrent root sysctl writes then race a GET_DEVICE_INFO walk against array teardown -> UAF read -> panic or kernel-pointer copyout. The guest has no HighPoint controller (pciconf: 0 devices; hw.hptmv.status OID absent - registered from attach), and without one the path NULL-derefs before gui_lib.c (known DF-1853). Root-only both sides, narrow window: Low.",
  "exploit_chain": "",
  "evidence": "VERDICT.md full path:line trace; env.txt: pciconf grep count 0 and sysctl: unknown oid hw.hptmv.status",
  "kernel_refs": [
    "sys/dev/raid/hptmv/gui_lib.c:163",
    "sys/dev/raid/hptmv/gui_lib.c:243",
    "sys/dev/raid/hptmv/gui_lib.c:496",
    "sys/dev/raid/hptmv/gui_lib.c:36",
    "sys/dev/raid/hptmv/ioctl.c:316",
    "sys/dev/raid/hptmv/ioctl.c:219",
    "sys/dev/raid/hptmv/ioctl.c:357",
    "sys/dev/raid/hptmv/hptproc.c:614"
  ],
  "poc_changes": "no runnable PoC possible without the HBA; evidence is the code trace plus guest hardware-absence capture",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "pciconf -l | grep -icE 11ab|hpt   -> 0",
  "code_hash": "",
  "notes": "Low severity (root-only race). No fix.diff shipped (unverified). Fix direction: take the driver lock for the read-only dispatch group and DELETE_ARRAY, or refcount PVDevice for GET_* walks.",
  "recommended_fix": "Serialize the read-only ioctl group and DELETE_ARRAY under lock_driver()/lock_driver_idle like the mutating ioctls (ioctl.c:357-371)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "",
  "fix_evidence": ""
}