⬢ DragonFlyBSD Kernel Audit
DF-4499 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4499",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info finding verified by source and guest inspection: the entire kfd2kgd backend of amdgpu_amdkfd_gfx_v9.c is dead code on DragonFly (CONFIG_HSA_AMD undefined tree-wide forces kgd2kfd=NULL, probe early-returns, adev->kfd NULL, and no amd/amdkfd frontend or /dev/kfd exists). No PoC is applicable - the unreachability itself is the verified fact; guest confirms no AMD PCI devices, no /dev/dri, no /dev/kfd, no drm KLDs. Latent hazards for the day KFD is enabled are documented and guarded by fix.diff.",
  "exploit_chain": "",
  "evidence": "env.txt (guest: no 0x1002 devices, /dev/dri and /dev/kfd absent); amdgpu_amdkfd.c:33-50,59-71,514-523 (dead-code chain); VERDICT.md (in-bounds confirmations + latent hazards)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:169-225",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:291-346",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:372-390",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:830-837",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c:1015-1052",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:33-50",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:59-71",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:514-523"
  ],
  "poc_changes": "not applicable (no trigger; verification = dead-code proof + guest device-absence evidence)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "grep -rn CONFIG_HSA_AMD sys/ ; pciconf -l | grep 1002",
  "code_hash": "",
  "notes": "Info severity: PoC skipped per contract (Low/Info). Status inconclusive used only because the strict set has no not_testable value; the dead-code claim itself is certain.",
  "recommended_fix": "when enabling KFD: add engine_id<2 and vmid<16 guards (fix.diff) and fix the (1<<vmid) shift UB in amdgpu_amdkfd_is_kfd_vmid",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ as hardening for currently dead code; no runtime validation applicable",
  "fix_evidence": "fix.diff"
}