⬢ DragonFlyBSD Kernel Audit
DF-4617 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4617",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "hdacc_stream_intr (hdacc.c:708) and hdacc_stream_free (hdacc.c:668) index codec->streams[dir][stream] with the controller-derived HDA stream tag without any bounds check. The DF-4115 BSS-tag sign error in hdac.c:1934 produces negative tags on BSS>0 controllers (stored with dev!=NULL at hdac.c:1940-42), and any stream interrupt for such a slot dispatches through an out-of-bounds-read device_t \u2014 a wild indirect call (certain crash; fault-injection class, not a new privilege boundary since a malicious controller already owns DMA). Not reproduced live: this guests QEMU ICH6 reports OSS 4, ISS 4, BSS 0 (runtime caps, findings/poc/DF-4115/caps.txt), making the BSS branch structurally unreachable; the in-bounds path was exercised live (320KB playback through hdacc0/hdaa0/pcm0, RC=0, no panic).",
  "exploit_chain": "hostile/faulty HDA controller reports GCAP BSS>0 with 2*num_oss+j>15 -> hdac_stream_alloc stores negative tag with dev!=NULL -> controller asserts that streams INTSTS bit -> hdac_one_intr (hdac.c:392-394) -> hdacc_stream_intr indexes streams[dir][negative] -> OOB-read device_t -> HDAC_STREAM_INTR wild indirect call. Hardware-gated; unreachable on BSS=0 controllers.",
  "evidence": "VERDICT.md (full path:line chain); dmesg.txt (guest codec chain + playback RC=0); fix.diff (sink clamps, git apply --check clean); findings/poc/DF-4115/caps.txt (hdac0: Caps: OSS 4, ISS 4, BSS 0 on this same guest image)",
  "kernel_refs": [
    "sys/dev/sound/pci/hda/hdacc.c:57",
    "sys/dev/sound/pci/hda/hdacc.c:663",
    "sys/dev/sound/pci/hda/hdacc.c:668",
    "sys/dev/sound/pci/hda/hdacc.c:702",
    "sys/dev/sound/pci/hda/hdacc.c:708",
    "sys/dev/sound/pci/hda/hdac.c:1932",
    "sys/dev/sound/pci/hda/hdac.c:1940",
    "sys/dev/sound/pci/hda/hdac.c:392"
  ],
  "poc_changes": "No seeded PoC existed; wrote a negative-result run.sh (codec attach + /dev/dsp playback battery) and the path-analysis verdict instead.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "n/a (no kernel build; runtime negative-result verification)",
  "run_cmd": "./run.sh (vm.sh run_root dd if=/dev/urandom of=/dev/dsp bs=8k count=40)",
  "code_hash": "",
  "notes": "Guest-live codec chain confirmed (hdac0/hdacc0/hdaa0/pcm0). Trigger hardware-gated off on guest (BSS=0) \u2014 same gate DF-4115 hit. hdaa.c:2170 sid <= 0 guard makes the stream_free NULL-write sink currently unreachable via hdaa; stream_intr sink is the live one because hdac.c stores dev!=NULL with the negative tag regardless of hdaas rejection. Fix upstream root cause per DF-4115 (hdac.c one-token fix); fix.diff adds sink clamps in hdacc.c.",
  "recommended_fix": "Clamp dir/stream at both hdacc sinks (reject dir outside 0..1, stream outside 1..15) as in fix.diff; fix the DF-4115 feeder arithmetic in hdac.c:1934.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Trigger hardware-gated off on this guest (GCAP BSS=0) \u2014 no baseline misbehavior exists to compare; fix.diff is git-apply-able and the patched-tree happy path is unchanged by construction (clamps only reject invalid indices that cannot occur on this hardware).",
  "fix_evidence": "fix.diff; git apply --check clean; playback battery in dmesg.txt"
}