⬢ DragonFlyBSD Kernel Audit
DF-4708 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4708",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "amr_sglist_maps goto retry loop (amr_pci.c:592-603, the documented sub-0x2000 XXX hack) leaks the rejected s/g table and its dmamap on every iteration and has no retry bound; because bus_dmamap_loads return value is ignored (amr_pci.c:599) and the helper never runs on failure, a persistent load failure leaves amr_sgbusaddr==0 which always satisfies < 0x2000 -> unbounded leak at attach until kmem exhaustion. amr_setup_mbox (amr_pci.c:654-660) and amr_ccb_map (amr_pci.c:698-699) repeat the unchecked load; in the mailbox case an uninitialized stack baddr would become sc->amr_mailboxphys, the physical completion-DMA address handed to the controller (speculative: 1-segment load of just-allocated constraint-matched memory practically cannot fail). Hardware-gated: no MegaRAID controller on the audit guest, so no runtime confirmation; filed as Info hardening.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (leak trace + loop-unbound proof); README.md; guest gate evidence in ../DF-4705/guest_session.log (no amr PCI device)",
  "kernel_refs": [
    "sys/dev/raid/amr/amr_pci.c:592",
    "sys/dev/raid/amr/amr_pci.c:599",
    "sys/dev/raid/amr/amr_pci.c:600",
    "sys/dev/raid/amr/amr_pci.c:654",
    "sys/dev/raid/amr/amr_pci.c:660",
    "sys/dev/raid/amr/amr_pci.c:698"
  ],
  "poc_changes": "no seed; static analysis finding, no runnable trigger (attach-time, hardware-gated)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info hardening; hw-gated. The sub-0x2000 leak itself is certain-on-trigger (documented XXX admits leaking); the load-failure branches are labeled speculative.",
  "recommended_fix": "check bus_dmamap_load returns, free/unload the rejected block before retrying, and bound the retry count (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation impossible on this guest (no amr hardware to run the attach path); diff authored from the line-accurate trace",
  "fix_evidence": "fix.diff (sglist retry bound + unload/free + three checked loads)"
}