⬢ DragonFlyBSD Kernel Audit
DF-4664 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2,
  "guest_dirty": 0,
  "build_cmd": "(none \u2014 hardware-gated path; source-verified)",
  "code_hash": "",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is a total two-line/one-line guard (git-apply --check verified against the pristine tree; never applied to sys/). No runtime fix validation: the defective path requires AMD DC hardware absent from the audit guest (0x1002 PCI count = 0).",
  "fix_evidence": "fix.diff in pack; run.log/env.txt hardware inventory.",
  "finding_id": "DF-4664",
  "verdict": "Code-provable uninitialized-stack disclosure to the kernel log: type2_dongle_buf[0x20] (dc_link_ddc.c:436) is never initialized and is only written by i2c_read on success (:445-449); on the common failure path (no responder at 0x40 \u2014 the normal signature of a DP-DVI passive dongle) all six CONN_DATA_DETECT branches (:453,:499,:507,:514,:530,:537) hexdump all 32 bytes via dc_conn_log_hex_linux (log_helpers.c:31-38) -> DC_LOG_DEBUG == DRM_DEBUG_KMS (logger_types.h:35). With drm.debug enabled, each such hotplug emits 32 bytes of stale kernel stack to the log readable by unprivileged users. Not reproduced: audit guest has no AMD GPU (0x1002 count = 0) and no DP sink; exposure additionally gated on drm.debug.",
  "exploit_chain": "",
  "evidence": "VERDICT.md citations (dc_link_ddc.c:436,:445-457; include/logger_interface.h:102-107; basics/log_helpers.c:31-38; include/logger_types.h:35); run.log hardware inventory.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:436",
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:445",
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:453",
    "sys/dev/drm/amd/display/dc/basics/log_helpers.c:31",
    "sys/dev/drm/amd/display/include/logger_types.h:35"
  ],
  "poc_changes": "No executable PoC (hardware-gated); source trace + guest hardware inventory documented.",
  "notes": "Exposure channel config-gated (drm.debug) \u2014 Info severity, defense-in-depth zero-init (file already uses = {0} style at :744).",
  "recommended_fix": "Zero-initialize type2_dongle_buf at declaration (fix.diff).",
  "run_cmd": "vm.sh run_root pciconf -l | grep -c 1002  (-> 0)"
}