⬢ DragonFlyBSD Kernel Audit
DF-4404 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4404",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel-side defect certain: u32 overflow in amdgpu_uvd_cs_msg_decode (sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:531-533,596-611,666-674) collapses min_dpb_size/min_ctx_size to 0 for non-dividing stream types (VC1/MPEG2/MPEG4/H265) with width=0x80000000/height=2, bypassing the dpb_size gate (line 686) and the pass2 mapping gate (line 833); proven by exact-arithmetic replica on the guest (run.log) and by upstreams own fix (Linux 05e1387d151f Reject UVD message with dimensions above 4096, 2026-07-30, absent from this tree). Runtime PoC impossible on the audit guest: no AMD GPU (QEMU bochs VGA only), amdgpu.ko loads but /dev/dri never appears, so the CS ioctl chain cannot execute; impact not demonstrated (inconclusive), not refuted.",
  "exploit_chain": "",
  "evidence": "run.log/run.2.log Part A (u32 wrap: min_dpb_size=0, both gates PASS); env.txt (bochs-only VGA, amdgpu.ko loaded, no /dev/dri); VERDICT.md full trace; fix.diff mirrors upstream clamp and applies cleanly (git apply --check)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:514",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:531",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:596",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:666",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:686",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:833",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:983",
    "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:1005"
  ],
  "poc_changes": "Trigger written fresh (no seed): Part A replicates kernel u32 arithmetic; Part B implements the device-open stage of the GEM/VA/CS chain and stops honestly when no AMD GPU is present. Needed -I/usr/src/sys/dev/drm/include (asm/int-ll64.h) and #define __user empty for userland UAPI compile.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -I/usr/src/sys/dev/drm/include/uapi -I/usr/src/sys/dev/drm/include -o uvd_dim_overflow uvd_dim_overflow.c",
  "run_cmd": "/root/df4404/uvd_dim_overflow",
  "code_hash": "5e5ce91625cc47213e90f32128381b02cfbbd15789b56c23f4b038df316729fe",
  "notes": "Reserved-ID evidence pack written by df-bsd-reviewer during pass-2 audit of sys/dev/drm/amd/amdgpu/amdgpu_uvd.c. Known findings DF-1595 (div0) / DF-1596 (destroy filp) not re-reported; this is the sibling overflow that the same upstream clamp fixes. Upstream refs: torvalds/linux 05e1387d151f, 3e41d26c70b0. Guest hardware absence is the only blocker to reproduction; on real AMD hardware impact ceiling is cross-process GPU-object/GTT host-page corruption (GPU runs physical addressing, amdgpu_uvd.c:983).",
  "recommended_fix": "Reject width/height < 16 or > 4096 in amdgpu_uvd_cs_msg_decode (mirror upstream 05e1387d151f + 3e41d26c70b0); see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff mirrors the upstream clamp and git-apply --check passes against sys/, but a patched-kernel A/B run is impossible on this guest (no AMD GPU to attach amdgpu, so neither baseline nor patched path can execute).",
  "fix_evidence": "fix.diff; git apply --check output in session log; upstream commits 05e1387d151f / 3e41d26c70b0"
}