⬢ DragonFlyBSD Kernel Audit
DF-4602 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4602",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "speculative",
  "verdict": "A severe guest-wide starvation event (sshd banner-exchange timeouts for minutes, 94-107% qemu CPU with oscillating load, continuing feeder_build_format/feeder_build_rate console spam) occurred ONCE, 1-3 minutes after unprivileged dsp format-change fuzzing (incl. vchan clones) combined with root churn of dev.pcm.0.play.{vchanrate,vchanformat}/bitperfect on a QEMU guest whose audio devices have no host backend (interrupts never fire). Two controlled re-runs after vm.sh reset with-src (minimal single-fuzzer; full original recipe) did NOT reproduce it - only one transient ssh timeout in ~7 minutes of full-recipe load. Root-cause stack could not be captured: DDB accepts input only on the serial console, which is file-backed on this rig (a Ctrl-Alt-Esc monitor break stopped all CPUs but no ps/bta was possible). Filed because (a) the event was real and whole-guest in scope, and (b) the in-file surface is indisputable: feeder_chain.c emits unconditional device_printf diagnostics on every failed rebuild (:153,:164,:227,:237,:305,:315,:361,:371,:429,:439,:472,:479,:509,:519) and every SETFMT/SPEED/CHANNELS ioctl destroys and rebuilds the chain (:575-579), so an unprivileged user can sustain an unbounded kernel console print rate (CWE-400 console-spam surface). Whether that surface alone (vs the dead-interrupt QEMU audio environment or driver-level lock churn) explains the starvation is undetermined.",
  "exploit_chain": "",
  "evidence": "wedge-serial-full.log (original session serial console: continuous pcm0/pcm1 feeder_build_* failure spam up to the Debugger(manual escape to debugger) DDB break); rerun1.log (minimal trigger, no wedge); rerun2.log (full recipe, no wedge, load 0.00 at end); env.txt (QEMU has no host audio backend - ALSA init fails on host, so guest audio interrupts never fire)",
  "kernel_refs": [
    "sys/dev/sound/pcm/feeder_chain.c:153",
    "sys/dev/sound/pcm/feeder_chain.c:164",
    "sys/dev/sound/pcm/feeder_chain.c:227",
    "sys/dev/sound/pcm/feeder_chain.c:237",
    "sys/dev/sound/pcm/feeder_chain.c:575",
    "sys/dev/sound/pcm/feeder_chain.c:578"
  ],
  "poc_changes": "n/a (fuzzer authored fresh for this batch; no seed PoC existed)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/feeder_fuzz /tmp/feeder_fuzz.c",
  "run_cmd": "/tmp/feeder_fuzz /dev/dsp0 75 11 (x5 across dsp0/dsp1 + concurrent root sysctl churn; see run.sh)",
  "code_hash": "a9a43abd13da32bd153311fc5cc53a0ea259bc2b21a922381a8acbef5dc6dd35",
  "notes": "No memory-safety defect found in feeder_chain.c itself (see audit negative notes). The wedge is a system-level livelock of unattributed root cause; the hardening fix.diff only removes the unbounded console-spam surface (gate 14 unconditional per-ioctl diagnostics behind snd_verbose > 0) and is NOT claimed to fix the livelock. Enum note: not_testable status is disallowed by the orchestrator mapping, hence inconclusive.",
  "recommended_fix": "Gate feeder_chain.cs per-ioctl failure diagnostics behind snd_verbose (fix.diff); if the livelock recurs on real hardware, capture ps/bta via a serial-input console or NMI panic and re-file with a determined root cause.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No reproducible baseline exists (one-shot event), so a single-fix kernel validation cannot be performed; the diff is a compile-safe hardening generated from the pristine file (applies by construction).",
  "fix_evidence": "fix.diff (182-line unified diff gating all 14 unconditional device_printf diagnostics in feeder_build_format/rate/matrix/volume/eq/root/mixer behind snd_verbose > 0; snd_verbose is extern in sound.h:314)"
}