⬢ DragonFlyBSD Kernel Audit
DF-4712 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-4712",
  "status": "untested",
  "reproduced": 0,
  "impact": "none demonstrated (hardware-gated: no Atheros NIC on guest; latent kernel OOB read/write below ah_txq[10] via negative q through ar5211SetTxQueueProps/ar5211GetTxQueueProps and unchecked AR_Q* MMIO in five HALASSERT-gated ops, if a future/buggy caller ever passes an unvalidated queue index)",
  "confidence": "certain",
  "verdict": "untested (runtime): ar5211SetTxQueueProps/ar5211GetTxQueueProps take signed int q and check only q >= HAL_NUM_TX_QUEUES, so q<0 reaches &ahp->ah_txq[q] (ar5211.h:121, HAL_NUM_TX_QUEUES=10) and ath_hal_setTxQProps (ah.c:951) writes ~15 fields through the OOB pointer; GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma gate q only via HALASSERT, which expands to nothing in production (ah_internal.h:669-676, no AH_ASSERT in X86_64_GENERIC - verified on guest). All in-tree callers pass driver-validated 0..9 (if_ath.c:4013-4032), so no trigger exists on the guest (no Atheros NIC - verified). Source-confirmed defect; ar5211 analogue of sibling DF-4519 (ar5212), which used the same bounds constant bug shape. Fix build-validated: nativekernel KERNCONF=X86_64_GENERIC BUILD_RC=0 with -Werror, patched ar5211_xmit.c compiled into the kernel (build.log:7139).",
  "exploit_chain": [],
  "evidence": "findings/poc/DF-4712/VERDICT.md (full reachability + killed-candidate narrative); build.log (full nativekernel log, BUILD_RC=0; decisive line 7139 ar5211_xmit.c -Werror); env.txt (no-ath pciconf proof, AH_ASSERT absent from X86_64_GENERIC); fix.diff (7 runtime q checks)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:84",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:89",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:100",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:405",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:415",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:435",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:458",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:480",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211.h:121",
    "sys/dev/netif/ath/ath_hal/ah_internal.h:665",
    "sys/dev/netif/ath/ath_hal/ah.c:951",
    "sys/dev/netif/ath/ath/if_ath.c:4013"
  ],
  "poc_changes": "n/a (no runtime PoC attempted; source-only confirmation per DF-4519/DF-2201 hardware-gated protocol)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2100,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src && patch -p1 < /tmp/df4712_fix.diff && make nativekernel KERNCONF=X86_64_GENERIC",
  "run_cmd": "n/a (no Atheros NIC on guest; no userland-reachable caller)",
  "code_hash": null,
  "notes": "ar5211 analogue of DF-4519 (ar5212_xmit, verified): same signed-q + inert-HALASSERT class, bounded by the constant HAL_NUM_TX_QUEUES (no DF-4520-style EEPROM halTotalQueues issue on 5211 - every op here uses the constant; the checks are simply signed-only/assert-only). Killed candidates documented in VERDICT.md (txRate0 shift in-field for all 5211 rate-table codes 0x08-0x0f; segLen<0x1000 in all reachable paths; GetTxIntrQueue stub safe because if_ath.c:2275 pre-inits txqs=0xffffffff; ProcTxDesc field extracts bounded).",
  "recommended_fix": "Replace the inert HALASSERT q-gates in ar5211GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma with runtime checks (return 0/AH_FALSE on bad q) and reject q<0 in ar5211SetTxQueueProps/ar5211GetTxQueueProps (mirrors accepted DF-4519 fix).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "build-only validation (runtime hardware-gated): fix.diff applied to guest /usr/src; make nativekernel KERNCONF=X86_64_GENERIC BUILD_RC=0 with -Werror; patched ar5211_xmit.c compiled into the kernel (build.log:7139). Baseline/patched runtime behavior not observable without an Atheros NIC.",
  "fix_evidence": "findings/poc/DF-4712/build.log (full untrimmed nativekernel log; decisive lines: 5505 mkdep ar5211_xmit.c, 7139 compile -Werror, final BUILD_RC=0)"
}