⬢ DragonFlyBSD Kernel Audit
DF-4562 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4562",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "SPECULATIVE, untested (needs a real mps HBA to produce the event interleaving; the QEMU guest has none, and unlike DF-4559/DF-4560 there is no deterministic arithmetic to replicate \u2014 the claim is about event TIMING). mpssas_add_device (mps_sas_lsi.c:653-670) and mpssas_volume_add (:847-853) overwrite/TAILQ_INIT a target slot without checking MPSSAS_TARGET_INREMOVAL, outstanding commands, or targ->tm, while mpssas_prepare_removes removal is asynchronous (TM TARGET_RESET completes later, mps_sas.c:449-466). A re-add event processed inside the removal window would clear INREMOVAL under an outstanding TM and re-init possibly-still-linked lists; completion-path TAILQ_REMOVE would then write through stale tqe_prev pointers into the re-initialized head. Adjacent to (not covered by) DF-3895/DF-3898. If real: list corruption / lost commands \u2014 availability-grade.",
  "exploit_chain": "",
  "evidence": "VERDICT.md and README.md contain the full path:line trace of the interleaving hypothesis; no runtime artifacts (no hardware).",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_sas_lsi.c:653",
    "sys/dev/raid/mps/mps_sas_lsi.c:667",
    "sys/dev/raid/mps/mps_sas_lsi.c:847",
    "sys/dev/raid/mps/mps_sas_lsi.c:212",
    "sys/dev/raid/mps/mps_sas.c:429",
    "sys/dev/raid/mps/mps_sas.c:449"
  ],
  "poc_changes": "No PoC possible on the available guest; filed as a labeled speculative pass-2 lifetime finding.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Labeled speculative per audit discipline. Recommended hardening: in mpssas_add_device/mpssas_volume_add bail with EBUSY when targ->handle != 0 && (flags & MPSSAS_TARGET_INREMOVAL || !TAILQ_EMPTY(&targ->commands) || !TAILQ_EMPTY(&targ->timedout_commands) || targ->tm != NULL).",
  "recommended_fix": "Guard target-slot re-initialization in mpssas_add_device/mpssas_volume_add against in-flight removal (INREMOVAL flag, non-empty command lists, outstanding tm).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_applicable (speculative finding, no reproducer)",
  "fix_evidence": "README.md hardening sketch."
}