⬢ DragonFlyBSD Kernel Audit
DF-4689 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4689",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED on the DragonFly guest (verbatim-extraction harness, mode 3): with an EEPROM-shaped dataset of flat pd-gain curves (all deltas 0 -- legal 4-bit EEPROM values, constructible by the stock decoder), sizeCurrVpdTable = Pmax_t2[ii]-Pmin_t2[ii] == 0 makes ar2425.c:465-466 index VpdTable_I[ii][(uint32)0-1] -> element 0xFFFFFFFF -> read at row+0x1FFFFFFFE bytes (+8.59 GB). The SIGSEGV handler asserts si_addr == &VpdTable_I[0][0] + 0x1FFFFFFFE exactly (0xa00478dee) -- the fault is pinned to this line. In-kernel: the wild read lands in the direct map (garbage Vpd_step) or a KVA hole (panic) on every channel set with such a curve (crafted EEPROM, or a flat-calibrated legit card). ar2425 keeps VpdTable_I in kernel static storage (:373), so the wild read is relative to .bss. Exploitation gated on crafted/flat-calibrated EEPROM AR2425 hardware; ceiling is DoS. Twin of DF-4622 (ar5413) / DF-4650 (ar2316) / DF-4662 (ar2413) / DF-4682 (ar2317). Fix validated: clamping the [-1]/[-2] accesses behind sizeCurrVpdTable>=2 removes the fault; patched mode 3 runs to completion.",
  "exploit_chain": "crafted-EEPROM AR2425 card -> ath attach -> ar2425SetPowerTable (channel set/reset) -> ar2425getGainBoundariesAndPdadcsForPowers -> OOB write/wild read; ceiling radio misprogramming/panic (DoS), not uid0",
  "evidence": "run.log: mode 3 ... REPRODUCED: SIGSEGV si_addr=0xa00478dee ... expected wild READ address 0xa00478dee ... MATCH; fix_run.log: PATCHED mode 3 ... no SIGSEGV: function completed on this build.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:465",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:466",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:475",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:458",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:450"
  ],
  "poc_changes": "ar2425-specific harness (vs DF-4680 template): the 5 function-scope static declarations (ar2425.c:367-379) are stripped from the verbatim extraction (asserted count) and re-bound to a guarded mmap block emulating kernel static storage -- ar2425 keeps the VpdTable/Pmin/Pmax scratch in .bss, not in ar2425State like the family twins; first build attempt had a macro/field name collision (offsetof) fixed by m_-prefixing the emulation fields; guest tar transfer ordering bug fixed (extract before overwrite)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df2425 && sh build.sh",
  "run_cmd": "cd /root/df2425 && sh run.sh",
  "code_hash": "636b2f3246c5e050c9c9e816348aa7314701607074df491027ffb367edd7c101",
  "notes": "hardware-gated (no AR2425 NIC on guest); verbatim-extraction methodology identical to accepted siblings DF-4619/4620/4622/4648/4649/4650/4660/4661/4662/4680/4681/4682/4683",
  "recommended_fix": "Guard the Vpd_step reads with sizeCurrVpdTable>=2 (fallback step 1) and clamp vpdLastIdx (fixC).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Harness-level validation (fix_validate.sh): baseline mode 3 dies with SIGSEGV si_addr exactly &VpdTable_I[0][0]+0x1FFFFFFFE (asserted MATCH); with fixC the mode completes (no SIGSEGV, minPower computed from real data). No kernel rebuild: no AR2425 hardware on the guest; validated against verbatim-extracted bodies per family methodology.",
  "fix_evidence": "run.log: mode 3 ... REPRODUCED: SIGSEGV si_addr=0xa00478dee ... expected wild READ address 0xa00478dee ... MATCH; fix_run.log: PATCHED mode 3 ... no SIGSEGV: function completed on this build."
}