⬢ DragonFlyBSD Kernel Audit
DF-4567 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{
  "finding_id": "DF-4567",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static verdict, defect proven at source level: ctb_write/ctb_read (sys/dev/drm/i915/intel_guc_ct.c:317-381,579-630) perform all ring arithmetic on GuC-firmware-writable descriptor fields (desc->size/head/tail, intel_guc_fwif.h:382-394) validated only by GEM_BUG_ON, which compiles to a no-op in production (i915_gem.h:56-61). desc->size==0 gives a divide-by-zero panic at intel_guc_ct.c:366/369/373 and :608/:624; inflated size/tail with suitable head passes the ENOSPC check (:347) and turns cmds[tail] writes (:365-374) into a wild kernel write up to ~1GiB past the 1-page CT object. However the whole CT path is unreachable on this tree twice over: no platform ever sets info.has_guc_ct (declared intel_device_info.h:94; i915_pci.c only sets .has_guc at :469/:520) so guc_enable_communication always picks MMIO mode (intel_uc.c:218-223), and enable_guc defaults to 0 as a root-only tunable (i915_params.h:49). Filed as Info hardening; no runtime PoC exists or is possible (guest has bochs std-VGA, no i915 device, and triggering requires signed-GuC-firmware misbehavior).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4567/VERDICT.md (full line-cited narrative); decisive lines: intel_guc_ct.c:324-335 (unchecked desc math + no-op GEM_BUG_ON), :347 (ENOSPC check on FW data), :365-373 (cmds[tail] write + % size divide), :582-594, :608/:624; i915_gem.h:60 (GEM_BUG_ON no-op); i915_pci.c:469 (has_guc only); intel_uc.c:218-223; i915_params.h:49. fix.diff applies clean (git apply --check verified).",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_guc_ct.c:317",
    "sys/dev/drm/i915/intel_guc_ct.c:324",
    "sys/dev/drm/i915/intel_guc_ct.c:332",
    "sys/dev/drm/i915/intel_guc_ct.c:347",
    "sys/dev/drm/i915/intel_guc_ct.c:365",
    "sys/dev/drm/i915/intel_guc_ct.c:366",
    "sys/dev/drm/i915/intel_guc_ct.c:373",
    "sys/dev/drm/i915/intel_guc_ct.c:579",
    "sys/dev/drm/i915/intel_guc_ct.c:590",
    "sys/dev/drm/i915/intel_guc_ct.c:608",
    "sys/dev/drm/i915/intel_guc_ct.c:624",
    "sys/dev/drm/i915/intel_guc_fwif.h:382",
    "sys/dev/drm/i915/i915_gem.h:56",
    "sys/dev/drm/i915/intel_uc.c:218",
    "sys/dev/drm/i915/i915_pci.c:469",
    "sys/dev/drm/i915/i915_params.h:49"
  ],
  "poc_changes": "none \u2014 no PoC source exists; the finding is a hardening defect on a path that cannot be selected on this tree (no platform sets has_guc_ct; enable_guc defaults 0). Runtime trigger additionally requires the signed GuC firmware to write an out-of-contract descriptor.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info-tier (fw-trust hardening). The same defect class was later fixed upstream (Linux i915 CT hardening replaced these GEM_BUG_ONs with real -EPROTO validation). Guest GPU is QEMU bochs (chip=0x11111234) so no i915 binding at all; even on Intel HW this tree cannot reach the code. Fix validation not performed: fix_status=not_testable (kernel build+boot of an unreachable path proves nothing); fix.diff included and git-apply verified against the read-only sys/ tree only.",
  "recommended_fix": "Replace the compiled-out GEM_BUG_ON descriptor checks in ctb_write/ctb_read with real validation of desc->size (== PAGE_SIZE/4 as allocated), desc->head/tail alignment and < size, returning -EPROTO before any divide or ring write (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: the vulnerable path is unreachable on this tree (no platform sets has_guc_ct; enable_guc default 0) and the guest has no Intel GPU, so baseline bad behavior cannot be produced to compare against a patched kernel; the diff is line-accurate against the read-only sys/ tree and git apply --check passes.",
  "fix_evidence": "findings/poc/DF-4567/fix.diff (git apply --check clean); VERDICT.md section fix.diff."
}