⬢ DragonFlyBSD Kernel Audit
DF-4377 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4377",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "probeCard() uses stack eeprom[256] uninitialized whenever readEEProm() fails (return ignored at bktr_card.c:667/794/1001/1129); garbage subsystem/model bytes are printed to console/dmesg at :676/:757/:814 and drive card selection. Not reproduced on the audit guest: no Bt848/878 hardware, /dev/bktr* absent (chk_bktr built and ran, exit 2). Defect is certain from source; manifestation is hardware-gated (EEPROM probe-ACK + read-NAK). Low-severity kernel-stack disclosure, same class as DF-2092 (cxm).",
  "exploit_chain": "",
  "evidence": "VERDICT.md path:line trace; run.log shows BUILD_OK_4377 then /dev/bktr0 not present EXIT=2 and pciconf brooktree count 0; env.txt guest state.",
  "kernel_refs": [
    "sys/dev/video/bktr/bktr_card.c:605",
    "sys/dev/video/bktr/bktr_card.c:667",
    "sys/dev/video/bktr/bktr_card.c:668",
    "sys/dev/video/bktr/bktr_card.c:676",
    "sys/dev/video/bktr/bktr_card.c:757",
    "sys/dev/video/bktr/bktr_card.c:794",
    "sys/dev/video/bktr/bktr_card.c:814",
    "sys/dev/video/bktr/bktr_card.c:1001"
  ],
  "poc_changes": "Probe written from scratch (finding is probe-time, no seed PoC existed); added <errno.h> after first guest compile failed; used guest-side b64decode for transfer.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -o chk_bktr chk_bktr.c",
  "run_cmd": "./chk_bktr",
  "code_hash": "9386fdc1896829667af01104182d3ec252e1b81a6342da85d15b644213b25f2b",
  "notes": "Phase V skip-class (Low, hardware-gated): run only a reachability probe; no marker to observe without a real card. Guest has no bktr PCI device (verified), so neither baseline nor fix can be exercised; the uninit path is not userland-triggerable (mapped_ioctl zero-fills IOC_OUT buffers, so BT848_REEPROM cannot disclose stack - only the probe-time kprintfs do). Knowns excluded: DF-1569 (block walk OOB), DF-3785/3786 (ioctl-side readEEProm/signCard bounds, filed under bktr_core.c), DF-1217, DF-4361.",
  "recommended_fix": "Zero-initialize eeprom[256] in probeCard() so failed EEPROM reads yield deterministic ids (fix.diff); alternatively honor readEEProm()s return at all four call sites.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (memset of eeprom[] in probeCard, read-only tree, never applied); cannot build/validate on the guest - no bktr hardware to observe the disclosure on a baseline kernel.",
  "fix_evidence": "fix.diff in this pack; guest device-absence evidence in run.log/env.txt."
}