⬢ DragonFlyBSD Kernel Audit
DF-4706 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4706",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "amr_pci_attach (amr_pci.c:263-268) connects amr_pci_intr before anything the handler consumes exists: sc->amr_get_work is assigned only inside amr_attach (amr.c:206-216) reached at amr_pci.c:346, locks are lockinitd at amr_pci.c:324-325, mailbox/sg/ccb DMA at 326-339. The IRQ is RF_SHAREABLE (amr_pci.c:257-258) and amr_pci_intr (461-470) has no status check and no AMR_STATE_INTEN gate, calling amr_done(sc) whose first action is the indirect call sc->amr_get_work(sc,&mbox) (amr.c:1782) \u2014 any co-line device interrupt in the attach window jumps to NULL: boot/kldload panic. Setup-side mirror of known DF-1820 (teardown-side); not a re-report. Cannot be exercised on the audit guest: no LSI MegaRAID PCI device exists in QEMU (verified: no 0x101e/0x1000:1960 device, /dev/amr* absent).",
  "exploit_chain": "",
  "evidence": "VERDICT.md 5-step trace with amr_pci.c:195,257-268,324-346 and amr.c:1782,206-216; guest gate evidence in ../DF-4705/guest_session.log (no amr PCI device, /dev/amr* absent)",
  "kernel_refs": [
    "sys/dev/raid/amr/amr_pci.c:257",
    "sys/dev/raid/amr/amr_pci.c:263",
    "sys/dev/raid/amr/amr_pci.c:346",
    "sys/dev/raid/amr/amr_pci.c:461",
    "sys/dev/raid/amr/amr.c:1782",
    "sys/dev/raid/amr/amr.c:206"
  ],
  "poc_changes": "no seed; conceptual trigger in README (kldload loop) \u2014 requires hardware absent from the guest",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hw-gated (LSI MegaRAID not emulated by QEMU). Probabilistic trigger (shared-line IRQ in ms-scale attach window) or deterministic with pre-asserting card. Complete fix also covers DF-1820s window via the AMR_STATE_INTEN gate.",
  "recommended_fix": "move bus_alloc_resource_any(SYS_RES_IRQ)+bus_setup_intr after amr_attach() succeeds and gate amr_pci_intr on AMR_STATE_INTEN (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation impossible on this guest: amr_pci_attach never runs without MegaRAID hardware (absent); diff authored from the line-accurate ordering trace",
  "fix_evidence": "fix.diff (setup_intr relocation + AMR_STATE_INTEN gate)"
}