⬢ DragonFlyBSD Kernel Audit
DF-4526 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4526",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-certain NULL-pointer dereference in ar5416AniControl(), hardware-gated on this guest (no ath(4) radio; QEMU cannot emulate the Atheros HAL). ar5416AniControl() guards only HAL_ANI_PRESENT/HAL_ANI_MODE against a missing current channel; every level/threshold command dereferences params (NULL whenever ah_curani==NULL, ar5416_ani.c:178-185) at :230/:317/:336 or writes through aniState at :296/:310. The ar5416 softc is allocated zeroed (ar5416_ani.c ah_curani is only published in ar5416AniReset, :561) and ar5416Attach() enables all commands (ah_ani_function=0xffffffff, ar5416_attach.c:244), so the function gate at :217 passes; HAL_DIAG_ANI_CMD (ar5212_misc.c:1098-1103, reachable from ar5416 via ar5416_misc.c:557) forwards user (cmd,param) verbatim -> immediate page fault -> kernel panic. On kernels built with options ATH_DIAGAPI (not stock GENERIC) the SIOCGATHDIAG entry has no privilege check (if_ath_ioctl.c:299-300; DF-2059/DF-4320), making it a local unprivileged panic there. Verified by full path trace + a compile-faithful userspace harness whose --deref mode executes the NULL load and takes SIGSEGV exactly on the replicated instruction (see run.log).",
  "exploit_chain": "",
  "evidence": "ani_null_deref.c, run.log (BUILD_OK + BUGGY/BUGGY-SIGSEGV/PATCHED outputs), VERDICT.md (path:line trace incl. attach-time state), fix.diff",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:177-185",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:217",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:230",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:296",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_attach.c:244",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_misc.c:1098-1103",
    "sys/dev/netif/ath/ath/if_ath_ioctl.c:299-302"
  ],
  "poc_changes": "No seed PoC. Wrote the decision-flow harness replicating the dispatch with attach-time state (zeroed softc + ah_ani_function=0xffffffff).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "guest: cc -O2 -Wall -o /root/ani_null_deref ani_null_deref.c",
  "run_cmd": "/root/ani_null_deref ; /root/ani_null_deref --deref ; /root/ani_null_deref --fixed",
  "code_hash": "56722a9190667b3929b61d44fbf69ee5a2aba36f77c9d1d694b87f783960776b",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware gate (no Atheros NIC emulatable in QEMU): in-kernel reproduction impossible in this environment; harness demonstrates the faulting instruction executes under attach-time state and that the one-line guard in fix.diff diverts the flow to AH_FALSE.",
  "fix_evidence": "run.log (--fixed mode), fix.diff",
  "notes": "Same gate class as DF-1676/DF-2511 packs. ar5212_ani.c has the identical structure and needs the same guard.",
  "recommended_fix": "Return AH_FALSE when aniState==AH_NULL after the PRESENT/MODE handling in ar5416AniControl()."
}