⬢ DragonFlyBSD Kernel Audit
DF-4761 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4761",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Analysis-only. 60 * crystal_clock_freq * 10000 (u32) wraps for any realistic xclk (25 MHz-class -> 1.5e10 > UINT32_MAX) in both the fan-RPM read (vega10_thermal.c:115) and the TACH-target set (:325) paths, producing systematically wrong fan telemetry and a skewed fan-regulation reference. The div-by-zero variant needs 8*speed==0 (speed==2^29) which the firmware-provided ulMinRPM/ulMaxRPM clamp makes unreachable on real VBIOS (crafted VBIOS + root hwmon write required). No memory-safety impact: all writes are masked register fields or named PPTable members; div-by-zero guards exist on the get paths. Guest has no AMD GPU, so not testable here; the arithmetic is source-provable (same expression as long-standing upstream Linux code).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4761/README.md (arithmetic walkthrough; no guest artifacts)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_thermal.c:115",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_thermal.c:110-111",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_thermal.c:314-325",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_thermal.c:80-84"
  ],
  "poc_changes": "none (no hardware on the audit guest)",
  "attempts": 0,
  "guest_uname": "n/a (guest has no AMD GPU; QEMU virtio hardware only)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info severity: correctness/hardening with no demonstrated security impact. File otherwise clean at the memory-safety level (audited end-to-end: register writes are REG_SET_FIELD-masked, PPTable writes are named fields, range inputs are driver-constant, no user pointers, no allocations, no work items, no IRQ registration in this file).",
  "recommended_fix": "Compute the RPM/TACH numerators in 64 bits (60ULL * crystal_clock_freq * 10000) before dividing",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not tested (no AMD GPU on the audit guest)",
  "fix_evidence": ""
}