⬢ DragonFlyBSD Kernel Audit
DF-4688 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4688",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED on the DragonFly guest (verbatim-extraction harness, mode 2): with an EEPROM-shaped zero-gain dataset (xpd_mask=0 -> all numVpd==0, the exact shape ar2413SetupRawDataset produces) the backfill loops index with uint32 counters at 0: pPdGainBoundaries[ii-1] (ar2425.c:485) and pPDADCValues[kk-1] (:489) wrap to element index 0xFFFFFFFF and read at array+0x1FFFFFFFE bytes (+8.59 GB) -- proven by mapping the exact wild pages (kernel direct-map emulation), seeding 0x5A5A and observing both values propagate into gainBoundaries[0] (-> AR_PHY_TPCRG5 via ar2425SetPowerTable:557-562) and pcdacTable[0] (-> 32 PHY reg writes, ar2425.c:548-555). ar2425-specific nuance vs the family twins: Pmin_t2/Pmax_t2 are FUNCTION-SCOPE STATICS (:377-379), so *pMinCalPower = Pmin_t2[0] at :431 is a STALE-STATIC read (residue of the previous channels calibration; harness 0xAAAA prefill propagates deterministically), not an uninitialized-stack read. In-kernel the +8.6GB read is a wild KVA read -> panic (KVA hole) or garbage radio programming; HALASSERT is compiled out in release. Exploitation gated on crafted-EEPROM AR2425 hardware (physical/supply-chain); ceiling is DoS/radio misprogramming. Twin of DF-4620 (ar5413) / DF-4649 (ar2316) / DF-4661 (ar2413) / DF-4681 (ar2317). Fix validated (early return + caller xpd_mask check): no wild reads, minPower sentinel untouched.",
  "exploit_chain": "crafted-EEPROM AR2425 card -> ath attach -> ar2425SetPowerTable (channel set/reset) -> ar2425getGainBoundariesAndPdadcsForPowers -> OOB write/wild read; ceiling radio misprogramming/panic (DoS), not uid0",
  "evidence": "run.log: gainBoundaries[0] = 0x5a5a ... pcdacTable[0] = 0x5a5a ... minPower out = 0xaaaa; fix_run.log: PATCHED mode 2 ... minPower=0x7c7c ... exit=1.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:485",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:489",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:431",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:377",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:639"
  ],
  "poc_changes": "ar2425-specific harness (vs DF-4680 template): the 5 function-scope static declarations (ar2425.c:367-379) are stripped from the verbatim extraction (asserted count) and re-bound to a guarded mmap block emulating kernel static storage -- ar2425 keeps the VpdTable/Pmin/Pmax scratch in .bss, not in ar2425State like the family twins; first build attempt had a macro/field name collision (offsetof) fixed by m_-prefixing the emulation fields; guest tar transfer ordering bug fixed (extract before overwrite)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df2425 && sh build.sh",
  "run_cmd": "cd /root/df2425 && sh run.sh",
  "code_hash": "636b2f3246c5e050c9c9e816348aa7314701607074df491027ffb367edd7c101",
  "notes": "hardware-gated (no AR2425 NIC on guest); verbatim-extraction methodology identical to accepted siblings DF-4619/4620/4622/4648/4649/4650/4660/4661/4662/4680/4681/4682/4683",
  "recommended_fix": "Early return when numPdGainsUsed==0 plus caller-side xpd_mask==0 -> AH_FALSE check in ar2425SetPowerTable (fixB).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Harness-level validation (fix_validate.sh): baseline mode 2 shows 0x5A5A from both wild pages propagating into gainBoundaries[0]/pcdacTable[0] and minPower=0xAAAA (stale static); with fixB the function returns before any backfill (gb[0]=0, pcdacTable[0]=canary 0xAAAA, minPower=sentinel 0x7c7c untouched). No kernel rebuild: no AR2425 hardware on the guest; validated against verbatim-extracted bodies per family methodology.",
  "fix_evidence": "run.log: gainBoundaries[0] = 0x5a5a ... pcdacTable[0] = 0x5a5a ... minPower out = 0xaaaa; fix_run.log: PATCHED mode 2 ... minPower=0x7c7c ... exit=1."
}