⬢ DragonFlyBSD Kernel Audit
DF-4733 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-4733",
  "status": "untested",
  "reproduced": 0,
  "impact": "none demonstrated (hardware-gated: no Atheros NIC on guest; latent kernel OOB read/write below ah_txq[3] via negative q through ar5210Set/GetTxQueueProps, plus unvalidated ah_txq[q] struct reads in five HALASSERT-gated ops, if a future/buggy caller ever passes an unvalidated queue index)",
  "confidence": "certain",
  "verdict": "untested (runtime): ar5210SetTxQueueProps/ar5210GetTxQueueProps take signed int q and check only q >= HAL_NUM_TX_QUEUES, so q<0 reaches &ahp->ah_txq[q] (ar5210.h:112, HAL_NUM_TX_QUEUES=3 for 5210 per ar5210.h:96) and ath_hal_setTxQProps (ah.c:951) writes ~15 fields through the OOB pointer; GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma gate q only via HALASSERT, which expands to nothing in production (ah_internal.h:669-676; AH_ASSERT absent from X86_64_GENERIC - verified on guest). All in-tree callers pass driver-validated indices (if_ath.c:4013-4032), so no trigger exists on the guest (no Atheros NIC - verified, pciconf 0 ath devices). Source-confirmed; ar5210 twin of verified DF-4519 (ar5212) and DF-4712 (ar5211). Fix build-validated: nativekernel KERNCONF=X86_64_GENERIC BUILD_RC=0 with -Werror (build.log:7129 ar5210_xmit.c), patched kernel installed and booted clean.",
  "exploit_chain": [],
  "evidence": "findings/poc/DF-4733/VERDICT.md (reachability + killed-candidate narrative); build.log (full nativekernel log, RC=0, decisive line 7129 ar5210_xmit.c -Werror); env.txt (no-ath pciconf proof; AH_ASSERT absent from X86_64_GENERIC); fix.diff (7 runtime q checks mirroring accepted DF-4519/4712 fix)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:40",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:56",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:262",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:287",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:372",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:406",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:433",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210.h:96",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210.h:112",
    "sys/dev/netif/ath/ath_hal/ah_internal.h:669",
    "sys/dev/netif/ath/ath_hal/ah.c:951",
    "sys/dev/netif/ath/ath/if_ath.c:4013"
  ],
  "poc_changes": "n/a (no runtime PoC attempted; source-only confirmation per DF-4519/DF-4712 hardware-gated protocol)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 4300,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src && patch -p1 < /tmp/df4733.diff && patch -p1 < /tmp/df4734.diff && patch -p1 < /tmp/df4735.diff && make nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
  "run_cmd": "n/a (no Atheros NIC on guest; no userland-reachable caller)",
  "code_hash": null,
  "notes": "ar5210 twin of DF-4519 (ar5212, verified) / DF-4712 (ar5211). Weaker than the 5211/5212 twins: no computed per-queue MMIO on 5210 (fixed AR_TXDP0/AR_TXDP1), so the assert-only ops are struct OOB reads only; 1<<q shifts sit behind real runtime checks; no DF-4520-style EEPROM halTotalQueues (ar5210_attach.c:368 uses the constant). Patched kernel (#1 Sep 23 04:06) installed and booted clean on the guest. Killed candidates in VERDICT.md (txRate0<<18 bleed only for 11b codes absent from 5210s 11a-only rate tables; FillTxDesc segLen bounded by 802.11 frame < 4096; ProcTxDesc fully masked; UpdateTxTrigLevel register-arithmetic only; GetTxIntrQueue stub pre-initd by if_ath.c:2275; SetupXTxDesc AH_FALSE caller-checked).",
  "recommended_fix": "Replace the inert HALASSERT q-gates in ar5210GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma with runtime checks (return 0xffffffff/AH_FALSE/0 on bad q) and reject q<0 in ar5210Set/GetTxQueueProps (mirrors accepted DF-4519/DF-4712 fix).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "build-only validation (runtime hardware-gated): fix.diff applied to guest /usr/src; make nativekernel KERNCONF=X86_64_GENERIC BUILD_RC=0 with -Werror (ar5210_xmit.c compiled, build.log:7129); kernel installed (INSTALL_RC=0) and booted clean (uname #1 Wed Sep 23 04:06:03). Baseline/patched runtime behavior not observable without an Atheros NIC.",
  "fix_evidence": "findings/poc/DF-4733/build.log (RC=0; decisive line 7129: cc ... ar5210_xmit.c -Werror); install+reboot sequence in this packs VERDICT.md"
}