⬢ DragonFlyBSD Kernel Audit
DF-4426 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4426",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "UINT8 loop-variable wraparound in acpi_hp_hpcmi_reads CMI enumeration (acpi_hp.c:1172,1178): when the WMI CMI GUID reports max_instance==254 and the SHOW_MAX_INSTANCE detail bit is set, maxInstance stays 255 and the error-break idiom instance = maxInstance wraps 255->0 on ++instance, restarting the loop forever while the global hp lockmgr lock (acpi_hp.c:1157) is held - unkillable kernel thread plus permanent wedge of hw.acpi.hp.* sysctls and /dev/hpcmi. Kernel-level reproduction is impossible on the audit guest (no PNP0C14/WMI firmware: no /dev/hpcmi, no hw.acpi.wmi sysctl - see env.txt), but the exact loop logic was extracted verbatim, compiled with DragonFly cc 8.3 ON the guest, and demonstrated: error-at-0 gives a pure 0-write infinite loop; error-at-5 re-appends cmi_order entries unboundedly (cmi_order_size hit 250000 in a capped run), which in-kernel also amplifies the DF-2382 cmi_order[128] overflow far past the >128-instances scenario. Distinct defect from DF-2382/DF-1606: different mechanism (wraparound restart vs missing bound), different minimal manifestation (no-write pure hang).",
  "exploit_chain": "",
  "evidence": "run.log: RUN err@0 300000 executions/0 inserts and RUN err@5 250000 inserts with VERDICT infinite-loop lines; VERDICT.md root-cause walk (acpi_hp.c:1145,1157,1165,1168,1172,1178; acpi_wmi.c:344); env.txt guest hardware absence; fix.diff dry-run applyable stop-flag fix",
  "kernel_refs": [
    "sys/dev/acpica/acpi_hp/acpi_hp.c:1145",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:1157",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:1165",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:1168",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:1172",
    "sys/dev/acpica/acpi_hp/acpi_hp.c:1178",
    "sys/dev/acpica/acpi_wmi/acpi_wmi.c:344"
  ],
  "poc_changes": "No PoC seed existed (new pass-2 finding). Wrote wrap_harness.c replicating the loop verbatim with stubbed WMI layer; compiled and executed on the DragonFly guest itself (cc 8.3 [DragonFly]) rather than the Linux host (no host compiler).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o wrap_harness wrap_harness.c (on guest)",
  "run_cmd": "./wrap_harness 0; ./wrap_harness 5; ./wrap_harness 254 noerr",
  "code_hash": "65f7eed2256137f00504ee0533d7ebc542d2c798f25ac9c223c043c153f86a99",
  "notes": "Guest lacks PNP0C14 (no /dev/hpcmi, no wmistat, no hw.acpi.hp/hw.acpi.wmi oids) so the kernel path cannot run there; harness proves loop arithmetic on the target OS. Root-only sysctl precondition (kern_sysctl.c:1446 SYSCAP_NOSYSCTL_WR) limits severity to Low. The no-write hang case is invisible to memory-corruption mitigations.",
  "recommended_fix": "Replace the instance = maxInstance error-break idiom with a stop flag tested at loop top (fix.diff), or use an int loop variable and break.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not possible: kernel path needs HP WMI firmware absent from the guest. fix.diff is control-flow-only and its effect is directly visible when applied to the harness loop (all runs terminate).",
  "fix_evidence": "fix.diff (patch -p1 dry-run verified against the read-only sys/ tree copy)"
}