⬢ DragonFlyBSD Kernel Audit
DF-4371 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4371",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain by static proof, not reproduced at runtime: the audit VM has no radeon GPU (only QEMU virtio VGA) so the radeon DPM attach path cannot execute, and the trigger additionally needs an induced kzalloc failure during VBIOS parse. The error paths of r600_parse_extended_power_table (r600_dpm.c:939/950-951/962-964) kfree already-parsed dyn_state entries and leave the pointers dangling; every family caller propagates the error; radeon_pm_fini calls radeon_dpm_fini unconditionally (radeon_pm.c:1705) and <asic>_dpm_fini -> r600_free_extended_power_table (r600_dpm.c:1299-1315) frees the same pointers a second time -> heap double free at driver teardown. Same family and calibration as DF-3973/4023/4117/4125 (Medium, AV:P/AC:H/PR:L).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line proof of both frees and the unconditional fini); trigger.md (fault-injection runbook); fix.diff verified APPLIES_CLEAN (patch -p1 --dry-run, scratch copy)",
  "kernel_refs": [
    "sys/dev/drm/radeon/r600_dpm.c:939",
    "sys/dev/drm/radeon/r600_dpm.c:950",
    "sys/dev/drm/radeon/r600_dpm.c:962",
    "sys/dev/drm/radeon/r600_dpm.c:829",
    "sys/dev/drm/radeon/r600_dpm.c:1299",
    "sys/dev/drm/radeon/radeon_pm.c:1705",
    "sys/dev/drm/radeon/btc_dpm.c:2577",
    "sys/dev/drm/radeon/btc_dpm.c:2727"
  ],
  "poc_changes": "No seed present; trigger documented as a runbook (hardware + fault injection required \u2014 no standalone userspace PoC can reach kernel VBIOS parsing)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Not runnable on this VM: no radeon hardware, no /dev/dri. Family precedent (DF-4023/DF-4117/DF-4125 poc_results) has the same device-absent limitation. Distinct from DF-3973 (btc_dpm.c caller-side instance): this is the shared root site inside r600_dpm.c itself.",
  "recommended_fix": "NULL every freed dyn_state pointer in the error paths and make r600_free_extended_power_table() idempotent by NULLing after each kfree (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored post-verification; applies cleanly (patch -p1 --dry-run) to a scratch copy of r600_dpm.c; runtime before/after validation impossible on this VM (no radeon hardware)",
  "fix_evidence": "findings/poc/DF-4371/fix.diff; dry-run output checking file sys/dev/drm/radeon/r600_dpm.c / DF4371_APPLIES_CLEAN"
}