⬢ DragonFlyBSD Kernel Audit
DF-4344 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4344",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain, kernel runtime hardware-gated: atiixp_chip_post_init() orders mixer_init() (atiixp.c:1085, publishing a 0666 /dev/mixerN whose si_drv1 devinfo is the AC97 codec) before pcm_register() (atiixp.c:1087, which can still fail EINVAL/ENODEV via pcm_veto_load or PCMMAXUNIT, sound.c:1021-1035); the postinitbad path then frees the codec (ac97_destroy, atiixp.c:1129-1132) and sc (atiixp.c:1165) while leaving the mixer cdev and the still-attached device pointing at freed memory -- any later mixer open/ioctl is a UAF through a kobj_deleted methods table, and suspend/resume NULL-deref through the devinfo pcm_register never stored. Identical construct to the four verified family members (DF-4156 maestro, DF-4193 es137x, DF-4299 emu10kx-pcm, DF-4334 via8233); this is the 5th instance. Not runtime-reproducible on the audit guest: QEMU has no ATI IXP AC97 controller (1002:4341/4361/4370/4382 absent, guest_check.log: kldload snd_atiixp loads but no pcm device attaches -- probe returns ENXIO). Incidental: kldunload of the module on the guest panics in sndstat_sysuninit, which is KNOWN DF-4116 (not re-reported).",
  "exploit_chain": "",
  "evidence": "VERDICT.md root-cause table (atiixp.c:1085-1115, mixer.c:687-737, ac97.c:852-859); guest_check.log (no ATI hardware, no attach); panic_df4116_on_atiixp_unload.txt (known DF-4116); fix.diff (mixer_uninit teardown, git apply --check OK)",
  "kernel_refs": [
    "sys/dev/sound/pci/atiixp.c:1085",
    "sys/dev/sound/pci/atiixp.c:1087",
    "sys/dev/sound/pci/atiixp.c:1113",
    "sys/dev/sound/pci/atiixp.c:1129",
    "sys/dev/sound/pci/atiixp.c:1165",
    "sys/dev/sound/pci/atiixp.c:1337",
    "sys/dev/sound/pcm/mixer.c:687",
    "sys/dev/sound/pcm/mixer.c:731",
    "sys/dev/sound/pcm/ac97.c:852",
    "sys/dev/sound/pcm/ac97.c:1037",
    "sys/dev/sound/pcm/sound.c:1016"
  ],
  "poc_changes": "no seed; family PoC shape (DF-4156/4334) adapted: trigger requires IXP hardware, guest probe substituted",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "n/a (no kernel PoC buildable without ATI IXP hardware)",
  "run_cmd": "kldload snd_atiixp; devinfo -v | grep pcm  (expect: loads, NO pcm device attaches)",
  "code_hash": "",
  "notes": "Hardware-gated on QEMU (no ATI IXP AC97 emulation); source-certain by symmetry with 4 verified family members. Guest was reset clean after the DF-4116 unload panic. Pass-2 negative results (killed classes) recorded in VERDICT.md: DMA ring geometry in-bounds (CHSEGS_MAX=256 slices, buildsgdt bounded), fragment math clamped (sndbuf_resize EINVAL path), codec waits bounded (500x DELAY(1)), no spdif parse path, pollticks divisor pinned 48000*align.",
  "recommended_fix": "On the postinitbad path call mixer_uninit(sc->dev) (destroys /dev/mixerN and, via ac97mix_uninit, the codec) before atiixp_release_resource, and NULL sc->codec to prevent the double ac97_destroy",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (git apply --check OK) tears the mixer down before release; mixer_uninit semantics verified against mixer.c:767-822 (destroy_dev + MIXER_UNINIT -> ac97_destroy). A patched-kernel run is impossible on this guest: atiixp_pci_attach requires the IXP controller the guest cannot emulate, so baseline/patched kernel behavior is not demonstrable here.",
  "fix_evidence": "fix.diff; VERDICT.md Fix validation section citing mixer.c:767-822 and ac97.c:1030-1038"
}