⬢ DragonFlyBSD Kernel Audit
DF-4428 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4428",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Deterministic kernel heap leak in smu10_hwmgr_backend_fini: smu10_populate_clock_table allocates seven dependency tables including vdd_dep_on_mclk (smu10_hwmgr.c:443-445, kzalloc(4+12*NUM_MEMCLK_DPM_LEVELS)) but backend_fini (:523-548) kfrees only six - the vdd_dep_on_mclk free is missing, so every hwmgr_hw_fini (hwmgr.c:258-259) on a Raven APU with a valid SMC clock table leaks ~52 bytes + bucket overhead permanently. Whole-tree rg confirms exactly three vdd_dep_on_mclk occurrences in the file: alloc at :443 and readers at :990/:1043, no free. Not runtime-testable here: the audit guest has no AMD GPU (pciconf 0x1002 count=0, no drm/amd klds - env.txt), so the amdgpu/powerplay backend cannot be instantiated; the finding is certain by inspection and compile-time deterministic.",
  "exploit_chain": "",
  "evidence": "VERDICT.md allocation/free asymmetry walk; smu10_hwmgr.c:443 (alloc) vs :528-539 (six frees, mclk absent); env.txt guest hardware absence; fix.diff dry-run-verified two-line free",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:399",
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:433",
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:443",
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:493",
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:523",
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.c:528",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:258",
    "sys/dev/drm/amd/powerplay/hwmgr/smu10_hwmgr.h:193"
  ],
  "poc_changes": "New pass-2 finding; no runtime PoC exists or is possible without Raven APU hardware. Evidence is code-citation based.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (requires Raven APU; guest pciconf shows zero AMD devices)",
  "code_hash": "",
  "notes": "Low severity resource leak (CWE-401). Secondary observation folded into VERDICT.md: backend_init ignores populate_clock_table failure (:493), leaving NULL tables that :990/:1043 readers would deref - firmware-fault class only. The :851 force_clock_level lead from the sibling audit was re-investigated and KILLED: its only consumers are amdgpu_pm.c sysfs handlers inside #if 0 blocks (lines 118-1720 and 2002-2092) and debugfs (CONFIG_DEBUG_FS undefined in sys/dev/drm/kconfig.h); no ioctl path reaches force_clock_level; and count==0 is impossible anyway (populate sets count to compile-time constants 3/4/8 or leaves the pointer NULL).",
  "recommended_fix": "Add kfree(pinfo->vdd_dep_on_mclk); pinfo->vdd_dep_on_mclk = NULL; to smu10_hwmgr_backend_fini next to the six sibling frees (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No Raven hardware available to build/observe; fix is a two-line symmetric free identical in shape to the six adjacent frees, patch -p1 dry-run verified.",
  "fix_evidence": "fix.diff"
}