⬢ DragonFlyBSD Kernel Audit
DF-4343 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4343",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static, deterministic defect class (attach error-path symmetry); runtime paths unreachable on the audit guest (no Munich32X PCI device, driver optional mn netgraph not built, kldload ENOENT). Verified from source: both BAR struct resource handles are stored only in the local res and discarded (if_mn.c:1302,1311) so they can never be released; the ENXIO returns at 1314, 1326, 1334 leak every previously allocated resource; mn_reset failure and ng_make_node_common failure return 0 = attach success (1353-1355, 1386-1389); the ng_name_node failure path frees the node (ng_rmnode+ng_unref, refs 1->0 because ngmn_shutdown is a no-op returning EINVAL) while sc->node keeps the dangling pointer and attach still reports success (1392-1396); there is no device_detach at all (1402-1411). Guest-side grep confirmation in run.log: 0 bus_release_resource, 0 device_detach in the file.",
  "exploit_chain": "",
  "evidence": "README.md (five cited sites); VERDICT.md; run.log (guest greps: 0 releases / 0 detach; hardware absent); fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/netif/mn/if_mn.c:1302",
    "sys/dev/netif/mn/if_mn.c:1311",
    "sys/dev/netif/mn/if_mn.c:1314",
    "sys/dev/netif/mn/if_mn.c:1326",
    "sys/dev/netif/mn/if_mn.c:1334",
    "sys/dev/netif/mn/if_mn.c:1353",
    "sys/dev/netif/mn/if_mn.c:1386",
    "sys/dev/netif/mn/if_mn.c:1392",
    "sys/dev/netif/mn/if_mn.c:1402",
    "sys/dev/netif/mn/if_mn.c:280"
  ],
  "poc_changes": "no runtime trigger exists for this class; source citations + guest greps are the demonstration",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "./run.sh guest  (see run.log)",
  "code_hash": "",
  "notes": "Low/hardening tier: privileged attach-time paths; resource leak (CWE-772), success-on-failure (CWE-252), dangling sc->node. Full device_detach additionally recommended upstream.",
  "recommended_fix": "Retain both BAR resource handles in softc, release them + IRQ on every error path, return ENXIO on mn_reset/node-creation/name failures and NULL sc->node after destroying it; add device_detach (fix.diff carries the minimal half)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No baseline possible on this guest (hardware absent). fix.diff is line-accurate (git apply --check clean) and restores error-path symmetry for every cited site except the still-recommended full device_detach.",
  "fix_evidence": "findings/poc/DF-4343/fix.diff"
}