⬢ DragonFlyBSD Kernel Audit
DF-4359 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4359",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "cik_sdma_init_microcode() assigns the amdgpu_ucode_validate() result to err but never checks it inside the per-instance loop, so only the final instances result is honored; a corrupt instance-0 SDMA firmware blob that fails the only consistency gate (fw->datasize == hdr->size_bytes) is accepted with err==0 and later consumed unvalidated by cik_sdma_load_microcode (the DF-1553 sink) \u2014 a distinct missed-error-propagation defect that a DF-1553 fix alone does not close. Runtime PoC impossible on the audit guest (no CIK AMD PCI device), static proof line-accurate; low severity since firmware replacement requires root.",
  "exploit_chain": "",
  "evidence": "README.md (loop excerpt cik_sdma.c:133-152 + validate body amdgpu_ucode.c:251-260); VERDICT.md (full narrative + guest pciconf check); guest pciconf shows no 0x1002 device",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:141",
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:950",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251",
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:552"
  ],
  "poc_changes": "none \u2014 no PoC seed; static verification only (hardware-gated path)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding on sys/dev/drm/amd/amdgpu/cik_sdma.c. Skipped runtime PoC per contract: Low severity, non-hot-bucket, path requires CIK AMD ASIC absent from QEMU guest (pciconf verified 2026-09-19). Distinct from known DF-1553 (different function/root cause); not a re-report.",
  "recommended_fix": "In cik_sdma_init_microcode, if (err) goto out; immediately after amdgpu_ucode_validate() so a failed validation of any instance aborts the load",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable \u2014 no CIK hardware on the audit guest; fix is a two-line error check mirroring the adjacent request_firmware check",
  "fix_evidence": "fix diff in README.md; no baseline/patched runs possible without the ASIC"
}