⬢ DragonFlyBSD Kernel Audit
DF-4742 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4742",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "vce_v2_0_sw_init sizes vcpu_bo at exactly FW+STACK+DATA (vce_v2_0.c:424-425 -> amdgpu_vce.c:181 bo_create_kernel) while vce_v2_0_mc_resume maps the VCPU cache windows starting AMDGPU_VCE_FIRMWARE_OFFSET=256 bytes into the bo (vce_v2_0.c:185-198): bo=704512 (exactly 172 pages, zero slack), DATA window ends at bo+704768 = bo_end+256, so the per-session DATA windows last 256 bytes lie in the VRAM object following vcpu_bo. Same defect shape as the filed v3 instance DF-4524; v4 is clean (clamps to amdgpu_bo_size, vce_v4_0.c:440). Arithmetic proven by check_arith.py (arith.log). End-to-end not runnable: guest has no AMD ASIC (QEMU bochs vgapci0 chip=0x11111234), and the actual fw write into the window tail is fw-behavior-dependent \u2014 hence speculative, mirroring DF-4524s treatment.",
  "exploit_chain": "",
  "evidence": "arith.log (bo size 704512/172 pages, window2 end 704768, overrun=256B); VERDICT.md negative-check list; env.txt (guest GPU absent)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/vce_v2_0.c:424",
    "sys/dev/drm/amd/amdgpu/vce_v2_0.c:185",
    "sys/dev/drm/amd/amdgpu/vce_v2_0.c:196",
    "sys/dev/drm/amd/amdgpu/amdgpu_vce.c:181",
    "sys/dev/drm/amd/amdgpu/amdgpu_vce.h:28"
  ],
  "poc_changes": "n/a (no seed; arithmetic harness written fresh)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "python3 check_arith.py",
  "run_cmd": "not runnable (no AMD hardware on guest)",
  "code_hash": "49ee091c5cc64b13fea7915925b33eeca1284c2246e0ace57bda6b6bc41baea5",
  "notes": "hw-gated (CIK VCE 2.0: Bonaire/Kaveri/Kabini/Hawaii/Mullins); needs amdgpu bound + VCE fw + render-node session; v3 sibling DF-4524, parser issues on amdgpu_vce.c are DF-4447/1625/1626 (not re-filed). fix.diff adds AMDGPU_VCE_FIRMWARE_OFFSET to the sw_init size.",
  "recommended_fix": "Add AMDGPU_VCE_FIRMWARE_OFFSET (256) to the amdgpu_vce_sw_init() size in vce_v2_0_sw_init(), or clamp CACHE_SIZEn windows to amdgpu_bo_size() v4_0-style",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: no AMD GPU on this guest, no baseline to flip. diff is arithmetic-exact against the verified window layout.",
  "fix_evidence": "fix.diff (+256 bytes to bo size => window2 end == bo end)"
}