⬢ DragonFlyBSD Kernel Audit
DF-4605 / run.log
← back to finding ↓ download raw
===== extracted guard.inc (amdgpu_acpi.c:374-385) =====
     1		/* Is this actually our event? */
     2		if (!atif ||
     3		    !atif->notification_cfg.enabled ||
     4		    type != atif->notification_cfg.command_code) {
     5			/* These events will generate keypresses otherwise */
     6	#if 0
     7	               if (event->type == ACPI_VIDEO_NOTIFY_PROBE)
     8	                       return NOTIFY_BAD;
     9			else
    10				return NOTIFY_DONE;
    11	#endif
    12		}
===== extracted deref.inc (amdgpu_acpi.c:387) =====
     1		if (atif->functions.sbios_requests) {
===== guard_fixed.inc (proposed fix applied) =====
     1		/* Is this actually our event? */
     2		if (!atif ||
     3		    !atif->notification_cfg.enabled ||
     4		    type != atif->notification_cfg.command_code) {
     5			/* These events will generate keypresses otherwise */
     6	        return;	}
===== build (kernel-style -O2) =====
===== run BASELINE (gutted guard, verbatim kernel lines) =====
sizeof(struct amdgpu_atif)=40  offsetof(functions.sbios_requests)=18
RESULT: SIGSEGV at address 0x12  (=&atif->functions.sbios_requests with atif==NULL, expected 0x12)
VERDICT: guard body compiled to NOTHING; control fell through the if() into the NULL deref
baseline exit=42
===== run FIXED (guard with restored return) =====
sizeof(struct amdgpu_atif)=40  offsetof(functions.sbios_requests)=18
RESULT: no fault — guard returned early (finding REFUTED in this mode)
fixed exit=0
PROOF-OK: baseline faults at NULL+0x12; fixed variant returns cleanly
workdir: /tmp/df4605.bVE3GL