⬢ DragonFlyBSD Kernel Audit
DF-4731 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4731",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "One-past-end guard defect in DAL_VALID_IRQ_SRC_NUM (irq_types.h:157-158, <= instead of <) trusted by amdgpu_dm_irq.cs register/unregister validation (:176/:193) before indexing irq_handler_list_{low,high}_tab[irq_source] (:238/:242/:123/:127), arrays sized [DAL_IRQ_SOURCES_NUMBER]=90 (amdgpu_dm.h:106-107). The guard math was proven on the DragonFly guest with a verbatim-enum harness (run.log: src=90 accepted, src=89 accepted, src=91 rejected - exactly one OOB index passes). The in-kernel path is untestable on this guest (no AMD GPU; no /dev/dri; only QEMU virtual VGA) and is latent anyway: every register caller passes in-range sources and amdgpu_dm_irq_unregister_interrupt has zero callers tree-wide. Inherited verbatim from upstream Linux v4.17.",
  "exploit_chain": "",
  "evidence": "run.log lines accept src=90 (ONE PAST) : true and RESULT: OFF-BY-ONE CONFIRMED; VERDICT.md reachability analysis (callers at amdgpu_dm.c:1274-1452 all in-range); env.txt documents absent AMD hardware",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/irq_types.h:157",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:176",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:238",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:242",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.h:106"
  ],
  "poc_changes": "n/a - harness authored fresh (verbatim enum+macro extraction from the tree), no seed PoC existed",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o df4731_proof df4731_proof.c",
  "run_cmd": "./df4731_proof",
  "code_hash": "b639027a84da01454b56fe3bab84614b3cac5200acb9c1810772bd02e821889d",
  "notes": "Guest /tmp artifacts removed. Upstream v4.17 carries the identical macro (verified against torvalds/linux v4.17 during this audit).",
  "recommended_fix": "irq_types.h:158 change <= to < in DAL_VALID_IRQ_SRC_NUM",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Single-character fix (fix.diff); cannot be kernel-validated without AMD GPU. The same harness logic confirms the fixed bound still accepts 0<src<90 and rejects 90+.",
  "fix_evidence": "fix.diff; VERDICT.md Fix validation section"
}