⬢ DragonFlyBSD Kernel Audit
DF-4612 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4612",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "init_transmitter_control (command_table2.c:181-183) switches on an uninitialized stack byte crev whenever amdgpu_atom_parse_cmd_header fails (returns false at amdgpu/atom.c:1412-1413 without writing *crev, i.e. the VBIOS master command table lacks the dig1transmittercontrol entry). BREAK_TO_DEBUGGER() is WARN_ON(1) in release, so execution falls through into switch(crev). Outcome is bounded: crev!=6 stores NULL (callers NULL-check, bios_parser2.c:1004) and crev==6 binds a handler whose EXEC then fails cleanly with -EINVAL (atom.c:1206-1207). No OOB, no leak - Low/hardening, the command_table2.c twin of DF-4047s v1 sub-issue. Not reproducible on the audit guest: no AMD GPU (virtio-vga only, see env.txt), so the DC firmware parser never runs.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-accurate trace: command_table2.c:176-192, amdgpu/atom.c:1405-1420, dc/os_types.h:72-79 WARN_ON release semantics, bios_parser2.c:1004 NULL check); env.txt (no AMD display device / driver on guest)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/command_table2.c:176",
    "sys/dev/drm/amd/display/dc/bios/command_table2.c:181",
    "sys/dev/drm/amd/display/dc/bios/command_table2.c:183",
    "sys/dev/drm/amd/amdgpu/atom.c:1412",
    "sys/dev/drm/amd/display/dc/os_types.h:76",
    "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1004"
  ],
  "poc_changes": "none - no PoC possible without AMD hardware; static trace only",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Guest lacks AMD GPU (env.txt: pciconf shows virtio-vga chip=0x11111234 only, no drm/amd modules) - the firmware DC parser path is unreachable there. Reviewed adjacent candidates and killed them: get_smu_clock_info_v3_1 memmove covers the full 4-byte output struct (atomfirmware.h:2178-2261) - no uninit read; all bios_parser2.c cmd_tbl call sites NULL-check; helper tables v1/v2 share command_table_helper_struct.h (no type confusion); NULL cmd_helper for unsupported DCE is unreachable because dc_create_resource_pool fails first (dc.c:626-647, dc_resource.c:104-112).",
  "recommended_fix": "Initialize crev=0 in init_transmitter_control so a failed BIOS_CMD_TABLE_REVISION cannot steer handler selection with an uninitialized stack byte.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline never manifests on this guest (no AMD GPU); fix is a one-line initialization with no behavioral risk. Cannot build an amdgpu DC kernel test on the QEMU std-vga guest.",
  "fix_evidence": "fix.diff initializes crev=0 at declaration; parse failure then takes the default NULL-handler path which bios_parser2.c:1004 already guards."
}