⬢ DragonFlyBSD Kernel Audit
DF-4663 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2,
  "guest_dirty": 0,
  "build_cmd": "(none \u2014 hardware-gated path; source-verified)",
  "code_hash": "",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is a total two-line/one-line guard (git-apply --check verified against the pristine tree; never applied to sys/). No runtime fix validation: the defective path requires AMD DC hardware absent from the audit guest (0x1002 PCI count = 0).",
  "fix_evidence": "fix.diff in pack; run.log/env.txt hardware inventory.",
  "finding_id": "DF-4663",
  "verdict": "Code-provable latent NULL deref: dal_ddc_service_query_ddc_data (dc_link_ddc.c:580-584 aux, :606-610 i2c) dereferences the result of dal_ddc_aux_payloads_create / dal_ddc_i2c_payloads_create without a NULL check. Both creators return NULL when the 16-byte kzalloc fails (OOM) or when dal_vector_construct rejects capacity==0 (write_size==0 && read_size==0 \u2014 basics/vector.c:33-37); the immediate dal_ddc_*_payloads_get(NULL) then reads NULL->payloads.container (struct vector first member, include/vector.h:29-35) -> near-NULL read -> panic. Zero-size case not reachable from current in-tree callers (SCDC :712-754, retimer dc_link.c:1641/:1694 all pass non-zero sizes), so today the path is OOM-gated inside the amdgpu DC driver. Not reproduced: the audit guest has no AMD GPU (pciconf 0x1002 count = 0, run.log) \u2014 same hardware gating as DF-4555/4556. Hardening finding; fix.diff adds the two missing NULL guards.",
  "exploit_chain": "",
  "evidence": "VERDICT.md root-cause citations (dc_link_ddc.c:580-584,:606-610; basics/vector.c:33-37; include/vector.h:29-35); run.log hardware inventory (no AMD device).",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:580",
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:584",
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:606",
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:610",
    "sys/dev/drm/amd/display/dc/basics/vector.c:33",
    "sys/dev/drm/amd/display/include/vector.h:29"
  ],
  "poc_changes": "No executable PoC (hardware-gated); evidence pack documents the source trace and the guest hardware absence.",
  "notes": "Info hardening per audit precedent (DF-0086-style latent NULL deref). DF-4555s caller-side ignored acquire() at dc_link_ddc.c:655-656 verified STILL PRESENT in sys/ but already covered by DF-4555 (its fix.diff Part 1 patches exactly that line) \u2014 deliberately NOT re-filed here.",
  "recommended_fix": "NULL-check both payloads create results and return false (fix.diff).",
  "run_cmd": "vm.sh run_root pciconf -l | grep -c 1002  (-> 0)"
}