⬢ DragonFlyBSD Kernel Audit
DF-4707 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4707",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "amr_pci_detachs only guard is AMR_STATE_OPEN (amr_pci.c:365-366), but amr_close clears that single bit on ANY close, not the last (amr.c:446), and amr_open sets it per open without counting (amr.c:430) \u2014 with two descriptors on /dev/amr0, one close defeats the guard, so a privileged kldunload proceeds to amr_pci_free (destroy_dev, softc/DMA teardown, amr_pci.c:371,477-527) while the surviving fds dev->si_drv1 (set amr.c:263, consumed amr.c:707) dangles -> use-after-free on the next management ioctl; an open racing past the detach check has the same effect (TOCTOU, no lock). Cannot be exercised on the audit guest: no MegaRAID hardware (no 0x101e/0x1000:1960 PCI device, /dev/amr* absent \u2014 verified).",
  "exploit_chain": "",
  "evidence": "VERDICT.md inspection trace (amr_pci.c:365, amr.c:430, amr.c:446, amr.c:263, amr.c:707); trigger.sh (fd-3/fd-4 + kldunload sequence); guest gate evidence in ../DF-4705/guest_session.log",
  "kernel_refs": [
    "sys/dev/raid/amr/amr_pci.c:365",
    "sys/dev/raid/amr/amr.c:430",
    "sys/dev/raid/amr/amr.c:446",
    "sys/dev/raid/amr/amr.c:263",
    "sys/dev/raid/amr/amr.c:707"
  ],
  "poc_changes": "no seed; trigger.sh authored (requires hardware)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "sh trigger.sh  # on MegaRAID-equipped system, as root",
  "code_hash": "",
  "notes": "hw-gated (no MegaRAID emulation in QEMU); unload requires privilege, victim fd can be an operator-group users; memory-safety fallout is a UAF read/write surface on the freed softc",
  "recommended_fix": "track an open-reference count (amr_opencnt) in the softc and make amr_pci_detach EBUSY while any descriptor remains open (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation impossible on this guest (no amr hardware); counter-based guard authored from the line-accurate inspection",
  "fix_evidence": "fix.diff (amrvar.h + amr.c open/close counting + amr_pci.c guard)"
}