⬢ DragonFlyBSD Kernel Audit
DF-4541 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4541",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Not executed: the hptmv ioctl channel is the root-only sysctl dev.hptmv.status and requires a HighPoint SATA RAID controller with a valid array; the QEMU audit guest has no such hardware. The defect is established by code trace: AS_INITIALIZE_START queues the rebuild DPC with flag VERIFY (ioctl.c:580) so rf_initializing is never set (only hpt_rebuild_data_block case INITIALIZE sets it, ioctl.c:720-727), the ioctl thread then polls for 80 seconds (ioctl.c:583-589) and returns 0 (success, ioctl.c:616) although the array was never initialized - silent failure of the data-hygiene initialize array operation plus an 80 s kernel-thread stall per call.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4541/VERDICT.md (full path:line trace); hptinit.c (faithful trigger packet: HPT_IOCTL_MAGIC + SET_ARRAY_STATE 0xFF0F + AS_INITIALIZE_START 7)",
  "kernel_refs": [
    "sys/dev/raid/hptmv/ioctl.c:580",
    "sys/dev/raid/hptmv/ioctl.c:583",
    "sys/dev/raid/hptmv/ioctl.c:616",
    "sys/dev/raid/hptmv/hptproc.c:614"
  ],
  "poc_changes": "authored from scratch; HPT_IOCTL_PARAM layout taken from hptintf.h:744-753, ioctl code HPT_CTL_CODE(15)=0xFF0F per hptintf.h:166,197",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 build X86_64_GENERIC x86_64 (no hptmv hardware)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o hptinit hptinit.c (NOT run - requires HighPoint HBA)",
  "run_cmd": "./hptinit <array-id> (NOT run - requires HighPoint HBA)",
  "code_hash": "",
  "notes": "Sibling wait loops (ioctl.c:494-500,519-525,543-549,562-568,602-608,430-436) share the timeout-returns-success protocol; only AS_INITIALIZE_START is guaranteed to hit it on every call.",
  "recommended_fix": "queue INITIALIZE instead of VERIFY at ioctl.c:580 and make the wait loops return failure on timeout",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable - requires HighPoint hardware",
  "fix_evidence": "VERDICT.md contains the one-line diff; not applied (sys/ read-only; no hardware to validate on)"
}