⬢ DragonFlyBSD Kernel Audit
DF-4408 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
 "finding_id": "DF-4408",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "dos",
 "verdict": "Source-verified NULL/wild-pointer dereference in acpi_asus_probe: the AcpiEvaluateObject(INIT) status is ignored (acpi_asus.c:579), Buf.Pointer is NULL on failure, Obj->String.Pointer is dereferenced with no Obj NULL or Type check (acpi_asus.c:586), and even the intended NULL-string branch falls through to strncmp(Obj->String.Pointer=NULL, ...) at acpi_asus.c:621 when the platform is neither Samsung ODEM nor ASUS010 EeePC. Deterministic kernel panic at probe (boot-time DoS) on any ATK0100/ASUS010 machine with a missing, failing, or non-String INIT method. Untested at runtime: the audit guest ACPI namespace has zero ATK0100/ASUS010 nodes (verified live, env.txt) so the driver never attaches; no unprivileged trigger path exists (probe runs at boot or under root-forced rescan; DSDT replacement requires root).",
 "exploit_chain": "",
 "evidence": "findings/poc/DF-4408/VERDICT.md (path:line trace incl. union-offset analysis for non-String returns), README.md, env.txt (live guest ACPI probe), fix.diff",
 "kernel_refs": [
  "sys/dev/acpica/acpi_asus/acpi_asus.c:579",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:586",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:605",
  "sys/dev/acpica/acpi_asus/acpi_asus.c:621"
 ],
 "poc_changes": "",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 10,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "9eacb0c96dfad1f1706521a77ac52e1723c1909b76637e51b2e99494fa992518",
 "notes": "Firmware-gated boot-time panic class (same family as historical Samsung P30 PRs upstream). Pass-2 sibling findings on this file: DF-4409 (notify-handler removal mismatch), DF-4410 (LED async task UAF), DF-4411 (probe mutates static model table).",
 "recommended_fix": "Validate AcpiEvaluateObject status, Obj != NULL, and Obj->Type == ACPI_TYPE_STRING before use, and make the NULL-string branch return ENXIO instead of falling through to strncmp(NULL); see fix.diff.",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored from source analysis; cannot be built/validated on the audit guest - driver only builds/attaches with ATK0100/ASUS010 firmware (optional acpi_asus, absent namespace).",
 "fix_evidence": "findings/poc/DF-4408/fix.diff; env.txt"
}