⬢ DragonFlyBSD Kernel Audit
DF-4433 / verdict.json
← back to finding ↓ download raw
{
 "finding_id": "DF-4433",
 "poc_id": "DF-4433",
 "status": "untested",
 "reproduced": 0,
 "impact": "Unkillable kernel busy-loop holding the interface serializer (SIOCGIFMEDIA path) / wedged interrupt thread (media_intr path); permanent network DoS",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Unbounded do/while DELAY(10) polls with no retry limit under ifnet serializer and in intr context. Bounded-poll fix in finding markdown.",
 "kernel_refs": [
  "sys/dev/netif/sln/if_sln.c:389",
  "sys/dev/netif/sln/if_sln.c:415",
  "sys/dev/netif/sln/if_sln.c:1025",
  "sys/dev/netif/sln/if_sln.c:1101"
 ],
 "verdict": "not_run: trigger needs SC92031 hw with wedged MII (absent in guest); unprivileged SIOCGIFMEDIA reachability of the generic dispatch demonstrated on guest (uid=1001 ifconfig media query)",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware-gated",
 "fix_evidence": "fix.diff in finding markdown"
}