⬢ DragonFlyBSD Kernel Audit
DF-4519 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
 "finding_id": "DF-4519",
 "poc_id": "DF-4519",
 "status": "untested",
 "reproduced": 0,
 "impact": "none demonstrated (no unprivileged trigger; latent OOB kernel read/write below ah_txq[0] via negative q, and UB 1<<q / unchecked MMIO addressing, if a future/buggy caller passes an unvalidated queue index)",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "HALASSERT expands to nothing without AH_ASSERT (ah_internal.h:669-676; only LINT64 defines AH_ASSERT); ar5212GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma have no other q check; SetTxQueueProps/GetTxQueueProps take signed int q and only check q >= halTotalQueues, so q<0 reaches &ah_txq[q] and ath_hal_setTxQProps (ah.c:951) writes through it. Fix build-validated: nativekernel rc=0 -Werror (build.log lines 7157/13453/14897).",
 "kernel_refs": [
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:91",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:96",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:109",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:114",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:517",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:527",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:547",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:569",
  "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:594",
  "sys/dev/netif/ath/ath_hal/ah_internal.h:669",
  "sys/dev/netif/ath/ath_hal/ah.c:951"
 ],
 "verdict": "untested (runtime): the five HAL xmit ops validate q only via HALASSERT (compiled out of production kernels) and Set/GetTxQueueProps let a signed negative q through their >= check down to &ah_txq[q]; all current callers pass driver-internal indexes 0..9, so no trigger exists on the guest (no Atheros NIC). Source-confirmed defect; fix.diff adds real runtime checks and build-validated rc=0 -Werror.",
 "poc_changes": "n/a (no runtime PoC attempted; source-only confirmation per DF-2201/DF-1766 HW-gated protocol)",
 "notes": "Same class as DF-2201 (ar5212_gpio) and DF-2073 (ar5212_keycache). Combined with DF-4520 (halTotalQueues clamp), ah_txq[] becomes fully bounded.",
 "recommended_fix": "Replace the inert HALASSERT bounds checks in ar5212GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma with runtime checks (return 0/AH_FALSE on bad q) and reject q<0 in ar5212SetTxQueueProps/ar5212GetTxQueueProps.",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "build-only validation (runtime HW-gated): fix.diff applied to guest /usr/src; make nativekernel KERNCONF=X86_64_GENERIC rc=0 with -Werror; ar5212_xmit.o rebuilt into kernel and module objects (build.log:7157,13453,14895-14897). Baseline/patched runtime not reproducible without an Atheros NIC.",
 "fix_evidence": "findings/poc/DF-4519/build.log (full untrimmed nativekernel log, BUILD_RC=0; decisive lines 3, 7157, 13453, 14895, 14897)",
 "build_cmd": "cd /usr/src && patch -p1 < /tmp/df4519_fix.diff && make nativekernel KERNCONF=X86_64_GENERIC",
 "run_cmd": "n/a (no Atheros NIC on guest; no userland-reachable caller)"
}