⬢ DragonFlyBSD Kernel Audit
DF-4360 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4360",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "cik_sdma_soft_reset() clobbers the mmSRBM_STATUS2 status variable with the mmSDMA0_F32_CNTL read inside the SDMA0 branch, so the following SDMA1_BUSY test examines the wrong register; whenever SDMA0 is busy the SDMA1 engine is never halted or soft-reset, leaving it wedged through resume and through the illegal-instruction reset path (cik_sdma_process_illegal_inst_irq -> reset_work) \u2014 a persistent local GPU denial of service on CIK hardware, availability-only. Runtime PoC impossible on the audit guest (no AMD PCI device); the stale-variable flow is unambiguous from source.",
  "exploit_chain": "(hardware-gated, not executed) unprivileged DRI client on CIK: queue work on both SDMA engines + inject illegal SDMA opcode -> illegal_inst IRQ -> schedule_work(reset_work) -> device reset -> cik_sdma_resume -> soft_reset skips SDMA1 (stale tmp) -> ring test fails -> device init error, GPU dead until reboot",
  "evidence": "README.md (annotated excerpt cik_sdma.c:1085-1104 + callers cik_sdma.c:502-508, 1047-1054, 1213-1220); VERDICT.md; guest pciconf shows no 0x1002 device",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:1089",
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:1093",
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:1098",
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:1051",
    "sys/dev/drm/amd/amdgpu/cik_sdma.c:1218"
  ],
  "poc_changes": "none \u2014 no PoC seed; static verification only (hardware-gated path)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding on sys/dev/drm/amd/amdgpu/cik_sdma.c. PoC skipped per contract: Low severity, requires CIK ASIC absent from QEMU guest (pciconf verified). Checklist item (e) suspend/resume symmetry hit; upstream-parity bug pattern (stale status register across reset branches).",
  "recommended_fix": "Keep the mmSRBM_STATUS2 snapshot in a separate variable (status) and test SDMA1_BUSY against it, not against the F32_CNTL RMW scratch",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable \u2014 no CIK hardware on the audit guest to compare baseline vs patched kernel",
  "fix_evidence": "fix diff in README.md"
}