⬢ DragonFlyBSD Kernel Audit
DF-4449 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4449",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "audio_regs[] (dce120_resource.c:322-329) defines 6 entries while res_cap.num_audio=7 (:440) and create_audio passes &audio_regs[inst] unchecked (:605-610). Upstream hit this exact mismatch and fixed it in commit 44035ec2fde1 (2022, Cc: stable) after a KASAN global-out-of-bounds in read_indirect_azalia_reg; the DF copy predates that fix. In the current DF tree the OOB is unreachable because resource_construct caps the audio loop at pipe_count (dc_resource.c:232, i < pipe_count && i < num_audio), so inst never exceeds 5 — latent hardening divergence: syncing dc_resource.c to the modern upstream loop resurrects the OOB. One-line upstream fix provided (add audio_regs(6)).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4449/VERDICT.md; array at dce120_resource.c:322-329 (6 entries), num_audio=7 at :440, consumer at :605-610, guard at dc_resource.c:232; upstream commit 44035ec2fde1 quoted in VERDICT.md",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:322",
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:440",
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:605",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:232"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 2026 x86_64 (guest has no AMD GPU)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info severity per contract for latent hardening findings; PoC skipped (no runtime path on any current config, and guest lacks AMD hardware). Tracked so the missing upstream stable fix is not lost during the next DC sync.",
  "recommended_fix": "Add audio_regs(6) to the audio_regs[] initializer — upstream commit 44035ec2fde1 verbatim (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line initializer fix matching upstream 44035ec2fde1; not buildable on the audit guest (no AMD GPU).",
  "fix_evidence": "findings/poc/DF-4449/fix.diff"
}