⬢ DragonFlyBSD Kernel Audit
DF-4728 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4728",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "au_rdcd (aureal.c:126-143) busy-DELAYS up to ~0.345s per register (sum_{j<50}(200j+2000)) and returns the last garbage read on timeout; au_wrcd (aureal.c:145-169) busy-waits up to 100ms, still writes the codec register when WROK never asserted, and always returns 0. On a wedged codec, mixer_inits ~100 register ops busy-spin tens of seconds inside attach, and runtime /dev/mixerN reads each spin ~0.35s. Availability/hardening only (Info), hw-gated, driver not in default build.",
  "exploit_chain": "",
  "evidence": "VERDICT.md busy-wait budget math; fix.diff",
  "kernel_refs": [
    "sys/dev/sound/pci/aureal.c:134",
    "sys/dev/sound/pci/aureal.c:137",
    "sys/dev/sound/pci/aureal.c:140",
    "sys/dev/sound/pci/aureal.c:152",
    "sys/dev/sound/pci/aureal.c:157",
    "sys/dev/sound/pci/aureal.c:159",
    "sys/dev/sound/pci/aureal.c:168"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Info-severity hardening; per audit policy no runtime verification needed (no observable behavior without failing hardware).",
  "recommended_fix": "Cap wait budgets, skip the write and signal failure on codec timeout",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: requires an unresponsive AU8820 codec.",
  "fix_evidence": "fix.diff authored against read-only sys/."
}