⬢ DragonFlyBSD Kernel Audit
DF-4763 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4763",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "NOT runtime-testable on the audit guest: fwe(4) requires an OHCI-1394 FireWire controller and the QEMU guest has none (env.txt / run.log: if_nametoindex(fwe0) -> Device not configured); QEMU has no 1394 device model - contract status not_testable, mapped to inconclusive for the poc_results enum. The bug itself is unambiguous straight-line code: M_PREPEND(m, ETHER_ALIGN, M_NOWAIT) at if_fwe.c:506 frees the mbuf chain and returns NULL on allocation failure (sys/sys/mbuf.h:465-482, sys/kern/uipc_mbuf.c:1500-1521), and fwe_as_output() unconditionally dereferences m->m_pkthdr.len at if_fwe.c:509 and 511 -> NULL+offset read -> guaranteed kernel panic. Reachable by any unprivileged local user sending traffic on an admin-configured fwe0 under mbuf starvation; pure DoS, no write primitive.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line proof incl. M_PREPEND contract); run.log (PoC builds BUILD_OK on guest, exits 2 fwe0 not present as root and unprivileged); fix.diff (NULL check returning xfer to the free list)",
  "kernel_refs": [
    "sys/dev/netif/fwe/if_fwe.c:506",
    "sys/dev/netif/fwe/if_fwe.c:509",
    "sys/dev/netif/fwe/if_fwe.c:511",
    "sys/sys/mbuf.h:465",
    "sys/kern/uipc_mbuf.c:1500",
    "sys/kern/uipc_mbuf.c:1511"
  ],
  "poc_changes": "Authored from scratch (no seed); if_nametoindex probe + SO_BROADCAST UDP flood; built and ran first try on guest (BUILD_OK, exit 2 hardware-absent).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o fwe_trigger fwe_trigger.c",
  "run_cmd": "./fwe_trigger fwe0   (plus mbuf-pressure spray on real hardware)",
  "code_hash": "9ce2d397e81255dd447f4c4ee1f858b257fb5c74c4cd982afd61aef5d841d1df",
  "notes": "Contract-status not_testable persisted as inconclusive (poc_results enum lacks not_testable). Guest left clean. Confidence certain refers to the bugs existence in code (deterministic deref of NULL on a documented failure path); triggering probability is governed by m_gethdr(M_NOWAIT) failure under memory pressure.",
  "recommended_fix": "Check m == NULL after M_PREPEND: count oerror, STAILQ_INSERT_TAIL the xfer back onto fwe->xferlist, and continue (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/; cannot validate on the guest (fwe driver cannot attach without OHCI-1394 hardware).",
  "fix_evidence": "fix.diff in this pack"
}