⬢ DragonFlyBSD Kernel Audit
DF-4662 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4662",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df2413 && sh build.sh",
  "code_hash": "649368a4f0ba8c2b3e06ce44e4570d0ca199c48de7f40bd49afefb09bcc22a81",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Validated on the guest: fixA+B+C applied to a copy of the pristine ar2413.c, function bodies re-extracted verbatim from the patched copy, harness rebuilt and re-run. Baseline reproduces the defect; patched build shows the defect GONE (mode 1: no overflow / mode 2: early return, sentinel minPower, no wild-read propagation / mode 3: completes without the wild-address SIGSEGV). fix.diff is git-apply-able against the pristine tree (git apply --check clean) and was never applied to sys/.",
  "fix_evidence": "fix_run.log (full patched 3-mode run) vs run.log (baseline); fix.diff in pack; PATCHES_APPLIED + FIXED_BUILD_OK in fix_run.log.",
  "verdict": "REPRODUCED on the DragonFly guest (verbatim-extraction harness, mode 3): with four used pdGains carrying FLAT EEPROM curves (all pwr_delta_t2 zero -> pwr_t4={124,124,124,124} -> Pmax_t2==Pmin_t2==62 -> sizeCurrVpdTable==0) the reads VpdTable_I[ii][sizeCurrVpdTable-1/-2] at ar2413.c:464-465 wrap the uint32 index to 0xFFFFFFFF/0xFFFFFFFE and read at row +0x1FFFFFFFE bytes (+8.59 GB): SIGSEGV with si_addr EXACTLY equal to &vpdTable_I[0][0]+0x1FFFFFFFE (0x20040286a), asserted in the handler; stable across two baseline runs. In-kernel the same wild read lands in the direct map (garbage Vpd_step -> garbage extrapolated PDADC values programmed to the radio via ar2413.c:471-479/:586-593) or in a KVA hole -> panic. sizeCurrVpdTable==1 (single-step curve) wraps the -2 term identically. Twin of DF-4622 (ar5413) / DF-4650 (ar2316). Hardware-gated (crafted EEPROM on an AR2413 card); no exfil channel, no uid0 route. Fix validated: clamping sizeCurrVpdTable to >=2 makes mode 3 complete without faulting.",
  "exploit_chain": "flat-calibrated/crafted v3 EEPROM curve on AR2413 card -> sizeCurrVpdTable==0 -> uint32-wrap wild read at vpdTable_I row+0x1FFFFFFFE on every channel set -> KVA-hole panic (or direct-map garbage -> radio misprogramming). No uid0 route.",
  "evidence": "run.log mode 3: REPRODUCED: SIGSEGV si_addr=0x20040286a, expected wild address 0x20040286a / MATCH; repeat section same address; fix_run.log patched mode 3: completes, no fault.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:457",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:464",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:465",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:471",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2413.c:586"
  ],
  "poc_changes": "Same harness as DF-4660 (mode 3); no kernel-code changes.",
  "notes": "Same uint32-underflow class as DF-4661 but different trigger (flat curve vs xpd_mask==0) and different guard; both distinct from known DF-1796 (numChannels==0, pass 1, NOT re-reported).",
  "recommended_fix": "Clamp sizeCurrVpdTable to >=2 before the VpdTable_I[ii][sizeCurrVpdTable-1/-2] reads (fix.diff).",
  "run_cmd": "./ar2413_harness 3",
  "attempts": 1
}