⬢ DragonFlyBSD Kernel Audit
DF-4729 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4729",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-2 finding: guc_ctl_log_params_flags() (intel_guc.c:296) dereferences guc->log.vma, which is provably always NULL on this port because intel_guc_log_create()s only call site is compiled out (#if 0, intel_guc.c:202-206) and log->vma is assigned nowhere else (intel_guc_log.c:489 is dead). intel_uc_init_hw (intel_uc.c:377) calls intel_guc_init_params unconditionally before firmware upload, so any root-enabled GuC load (i915.enable_guc=1/-1; default 0 at i915_params.h:49) on Gen9+ hardware takes i915_ggtt_offset(NULL) -> NULL deref -> kernel panic in both debug and release builds. Runtime verification impossible on the audit guest (QEMU virtual VGA chip=0x11111234, i915 never attaches); the static chain is machine-checked by verify.sh/static_proof.log. Severity Low: panic-only, hardware- and root-config-gated.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4729/static_proof.log (steps 1-8: dead call site, sole assignment, deref :296, unconditional caller :359, live chain via intel_uc.c:377 <- i915_gem.c:5746, i915_ggtt_offset deref, enable_guc=0 default); VERDICT.md (full narrative + killed candidates); verify.sh (runnable)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_guc.c:296",
    "sys/dev/drm/i915/intel_guc.c:202-206",
    "sys/dev/drm/i915/intel_guc.c:359",
    "sys/dev/drm/i915/intel_guc_log.c:489",
    "sys/dev/drm/i915/intel_uc.c:377",
    "sys/dev/drm/i915/i915_gem.c:5746",
    "sys/dev/drm/i915/i915_vma.h:202-208",
    "sys/dev/drm/i915/i915_params.h:49"
  ],
  "poc_changes": "No PoC seed existed; authored a runnable static proof script (verify.sh) instead of a hardware PoC since the finding is hardware-gated.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "./verify.sh . (static chain; no target hardware on guest)",
  "run_cmd": "./verify.sh . > static_proof.log 2>&1",
  "code_hash": "bfd994ced9c731631f0190de0b0ed41ac0c00f65d63c7285246e14874a181b87",
  "notes": "Contract Phase V skipped: Low severity, hardware-gated (no Intel Gen9+ GPU in QEMU), root-config-gated trigger (enable_guc default 0). Status recorded as untested (allowed enum; would be not_testable/skipped under the table taxonomy). Known DF-1826 (shared_data_vaddr dangling) NOT re-reported; no second consumer of shared_data_vaddr exists (only intel_guc_submission.c:635).",
  "recommended_fix": "Guard guc_ctl_log_params_flags() to return 0 when guc->log.vma is NULL (log subsystem compiled out on this port).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (NULL guard in guc_ctl_log_params_flags) but not build-validated: no Intel Gen9+ GPU on the audit guest, so neither baseline panic nor patched behaviour can be exercised.",
  "fix_evidence": "findings/poc/DF-4729/fix.diff"
}