⬢ DragonFlyBSD Kernel Audit
DF-4616 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4616",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ips_morpheus_poll (ips.c:611) computes its poll deadline as time_uptime + command->timeout, but command->timeout is in watchdog ticks of 10 s (set to 10 at ips.c:601, decremented once per 10 s callout at ips.c:342/369) while time_uptime is seconds - the synchronous completion window is 10 s instead of the intended 100 s. This poll is the crash-dump completion engine (ips_disk.c:322, interrupts disabled), so a controller slower than 10 s (cache-flush-heavy during a crash) makes the dump proceed on unacknowledged writes -> silently corrupted crash dumps or a wedged dump. Arithmetic is certain from source; not reproduced on the audit guest because it requires a morpheus ServeRAID controller (0x1014:0x01BD) as the dump device of a crashing kernel and the guest has none (env.txt). Secondary note: the poll calls ips_morpheus_check_intr without queue_lock (fine in dump context, latent race if ever reused).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (unit proof: ips.c:601 sets timeout=10, ips.c:342+369 decrement once per 10s tick, ips.c:611 deadline = seconds + ticks, ips_disk.c:321-322 sole caller is the dump path); env.txt (no ServeRAID hardware)",
  "kernel_refs": [
    "sys/dev/raid/ips/ips.c:601",
    "sys/dev/raid/ips/ips.c:607",
    "sys/dev/raid/ips/ips.c:611",
    "sys/dev/raid/ips/ips.c:342",
    "sys/dev/raid/ips/ips.c:369",
    "sys/dev/raid/ips/ips_disk.c:322"
  ],
  "poc_changes": "none - no PoC possible; requires morpheus ServeRAID dump device on crashing hardware.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "ips_copperhead_poll (ips.c:810-814) is a kprintf stub - the copperhead dump path has no completion mechanism at all, confirming this path is untested by design. Low severity: crash-dump integrity only.",
  "recommended_fix": "Scale the poll deadline to seconds: ts = time_uptime + (uint32_t)command->timeout * 10.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No ServeRAID dump device on the guest; A/B kernel run impossible. fix.diff is a one-line unit correction with no behavioral risk.",
  "fix_evidence": "fix.diff (ips.c:611 deadline scaled by the 10 s watchdog period)."
}