⬢ DragonFlyBSD Kernel Audit
DF-4734 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4734",
  "status": "untested",
  "reproduced": 0,
  "impact": "none demonstrated (hardware-gated: no Atheros NIC on guest; latent NULL-deref kernel panic if a DATA queue is reset before the first channel set)",
  "confidence": "certain",
  "verdict": "untested (runtime): ar5210ResetTxQueue caches AH_PRIVATE(ah)->ah_curchan (ar5210_xmit.c:157) and dereferences it unconditionally in IEEE80211_IS_CHAN_TURBO(chan) (:180; macro is a raw ->ic_flags deref, _ieee80211.h:268). ah_curchan is NULL from attach until the first ar5210Reset. Both sibling HALs guard exactly this with if (chan && ...) and the comment NB: chan can be NULL during attach (ar5211_xmit.c ar5211ResetTxQueue; ar5212_xmit.c ar5212ResetTxQueue - verified: chan appears only inside the guard in both); ar5210 missed it and its usage is broader (the whole turbo/normal IFS branch). In-tree call order protects (ath_attach resets before ath_txq_setup, if_ath.c:4125-4130) - latent. No Atheros NIC on the guest, runtime not observable. Fix build-validated: nativekernel BUILD_RC=0 -Werror (build.log:7129), kernel installed and booted clean.",
  "exploit_chain": [],
  "evidence": "findings/poc/DF-4734/VERDICT.md (divergence proof: sibling guards quoted); build.log (RC=0; ar5210_xmit.c -Werror at :7129); fix.diff (one-line NULL guard mirroring siblings); env.txt",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:157",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:180",
    "sys/netproto/802_11/_ieee80211.h:268",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c:84",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:91"
  ],
  "poc_changes": "n/a (no runtime PoC attempted; hardware-gated per DF-4519/DF-4712 protocol)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 4300,
  "guest_dirty": 1,
  "build_cmd": "cd /usr/src && patch -p1 < /tmp/df4734.diff && make nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
  "run_cmd": "n/a (no Atheros NIC on guest; no reachable caller with NULL chan in-tree)",
  "code_hash": null,
  "notes": "Precisely-scoped cross-version divergence: both sibling HALs guard+annotate, ar5210 forgot; latent NULL-deref panic class, caller-order-protected in-tree (same class family as DF-4519/4712/4733). Patched kernel (#1 Sep 23 04:06) installed and booted clean.",
  "recommended_fix": "Guard the deref: if (chan != AH_NULL && IEEE80211_IS_CHAN_TURBO(chan)) - one line mirroring the ar5211/ar5212 NULL-chan guards.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "build-only validation (runtime hardware-gated): fix.diff applied; nativekernel BUILD_RC=0 -Werror (build.log:7129 ar5210_xmit.c); kernel installed and booted clean. NULL-chan path not exercisable on the guest (no ath hardware).",
  "fix_evidence": "findings/poc/DF-4734/build.log (RC=0; ar5210_xmit.c -Werror at :7129); fix.diff"
}