⬢ DragonFlyBSD Kernel Audit
DF-4692 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4692",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-trace proven; not runtime-triggerable on the audit guest because no sili(4) HBA exists there (hardware-gated, not a false positive): sili_ata_get_xfer() returns NULL when the ccb free list is empty (sili.c:2322-2327 -> 2003-2018) and sili_pm_read (sili_pm.c:643-645), sili_pm_write (:680-682) and sili_pm_set_feature (:549-551) dereference xa->fis unconditionally. Live entry: every PM hot-plug async-notify pass runs sili_pm_read(ap,15,EINFO) from the port thread (sili.c:530) and sili_pm_check_good performs up to three more PM accesses per event (sili_pm.c:584,589,610); CAM I/O (issued under ap_sim_lock, sili_cam.c:122/202) coexists with port-thread PM maintenance, so a saturated port + one hot-plug event = NULL deref -> panic. Same class as DF-4237 (sili_cam.c), three further instances.",
  "exploit_chain": "",
  "evidence": "VERDICT.md Why the defect is real steps 1-5; env.txt proves the hardware gate; run.log shows the trigger driving 24+ XPT reset/rescan ops against the only buses present (ata0/ata1, nata).",
  "kernel_refs": [
    "sys/dev/disk/sili/sili_pm.c:549-551",
    "sys/dev/disk/sili/sili_pm.c:643-645",
    "sys/dev/disk/sili/sili_pm.c:680-682",
    "sys/dev/disk/sili/sili_pm.c:584-610",
    "sys/dev/disk/sili/sili.c:2317-2337",
    "sys/dev/disk/sili/sili.c:2003-2018",
    "sys/dev/disk/sili/sili.c:529-534"
  ],
  "poc_changes": "No seed existed; trigger written fresh for this pack (stdarg.h fix applied during guest build).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c",
  "run_cmd": "./trigger_sili_pm 15",
  "code_hash": "d828da682541b4da49c76cad80f4c6c846db506937fe2ce219ce1d9a38d4591e",
  "notes": "Medium: local DoS panic via device-timing condition (PM hotplug on saturated port); DF-4237 class.",
  "recommended_fix": "NULL-check sili_ata_get_xfer() result in sili_pm_set_feature/sili_pm_read/sili_pm_write and return EBUSY.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not testable: the guest has no SiI 3124/3132 HBA and QEMU does not emulate the SiL3726 port multiplier, so neither baseline nor patched kernel can reach sili_pm_* at runtime. fix.diff is a line-accurate source-level fix (all referenced helpers declared in sili.h); code-reviewed only.",
  "fix_evidence": "env.txt (PCI inventory, 0 sili dmesg lines); fix.diff"
}