⬢ DragonFlyBSD Kernel Audit
DF-4543 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4543",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Device-lifecycle defect verified by code trace but not exercisable on the audit guest: /dev/agpgart is created with hardcoded minor 0 and name agpgart (agp.c:240-242) while agp_free_cdev removes by device_get_unit (agp.c:248-251), and dev_ops_remove_minor matches by minor (kern_device.c) so for unit != 0 the node survives detach with dangling si_drv1; independently, destroy_dev only unlinks + drops link refs (devfs_core.c:1440-1463) so an open fd keeps the cdev (and si_drv1) alive past softc free, making later ioctl/mmap/close a UAF (agp.c:777/792/818/857). Guest liveness probe (run.log): /dev/agpgart absent, no AGP PCI capability on any of the 7 devices, bochs VGA only - the attach path never runs, and stock X86_64_GENERIC compiles agp in so no kldunload exists. Root-only trigger (0600 root:wheel node) on top of the hardware gate, so impact ceiling is a privileged UAF (robustness), not unpriv escalation.",
  "exploit_chain": "",
  "evidence": "run.log (ls /dev/agpgart -> ENOENT; pciconf -lc | grep -i agp -> empty; vgapci0 chip=0x11111234 bochs VGA); VERDICT.md section Code trace with path:line for each mechanism step; fix.diff for the proposed guard.",
  "kernel_refs": [
    "sys/dev/agp/agp.c:240",
    "sys/dev/agp/agp.c:242",
    "sys/dev/agp/agp.c:248",
    "sys/dev/agp/agp.c:250",
    "sys/dev/agp/agp.c:777",
    "sys/dev/agp/agp.c:792",
    "sys/dev/agp/agp.c:818",
    "sys/dev/agp/agp.c:857",
    "sys/kern/kern_device.c",
    "sys/vfs/devfs/devfs_core.c:1440",
    "sys/config/X86_64_GENERIC:170"
  ],
  "poc_changes": "No seed PoC existed; authored a liveness probe (poc_agp_liveness.sh) to prove the attack surface is absent on this guest rather than claim a false run.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 18,
  "guest_dirty": 0,
  "build_cmd": "n/a (nothing buildable: no AGP hardware, /dev/agpgart does not exist on guest)",
  "run_cmd": "findings/poc/DF-4543/run.sh  (vm.sh run_root liveness probe)",
  "code_hash": "e8b0b867c7c130751cdc06f84ced74f84c252bc6662fec911b7b2be73809aa90",
  "notes": "Hardening/robustness class finding (Low): root-triggerable UAF gated on AGP hardware + module-built agp or PCI hot-removal. Not among known DF-1685/1686/1687/1688/2397/2398/2399/2400 (none covers attach/detach lifecycle or the free_cdev unit-vs-minor mismatch). Guest left clean (probe was read-only).",
  "recommended_fix": "Guard agp_free_cdev with sc->as_isopen (return EBUSY, propagate from all chip detaches) and destroy the stored as_devnode via destroy_dev() instead of dev_ops_remove_minor(device_get_unit).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree but not buildable/testable on this guest: no AGP hardware means the agp driver never attaches, so neither baseline nor patched lifecycle can be driven. Baseline badness is established by code trace (VERDICT.md), not runtime.",
  "fix_evidence": "fix.diff (agppriv.h + agp.c + agp_via.c + agp_sis.c + agp_amd64.c + intel-gtt.c hunks); no fix_build.log/fix_run.log because no kernel with the agp lifecycle reachable can run on this QEMU guest."
}