⬢ DragonFlyBSD Kernel Audit
DF-4785 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4785",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "psp_v11_0_init_microcode (psp_v11_0.c:95-143) loads only the SOS firmware for Vega20; it never sets asd_fw/asd_start_addr/asd_ucode_size, diverging from both in-tree siblings (psp_v3_1.c:126-143, psp_v10_0.c:126-143) and from upstream mainline (v5.2 psp_v11_0.c loads vega20_asd.bin). The ASIC-agnostic psp_hw_start -> psp_asd_load (amdgpu_psp.c:291, 238-266) then executes memcpy(fw_pri_buf, NULL, 0) (UB, latent panic) and submits GFX_CMD_ID_LOAD_ASD with app_len=0 whose PSP rejection is swallowed by the ucode==NULL resp.status ignore (amdgpu_psp.c:137-142, DF-4768 class). Not runtime-verifiable on the audit guest: pciconf shows only QEMU/Intel virtual PCI (no AMD GPU), so the amdgpu PSP path is unreachable; severity Low with no attacker control. fix.diff mirrors the psp_v3_1 ASD load block; not runtime-validated for the same hardware reason.",
  "exploit_chain": "",
  "evidence": "Source divergence chain: psp_v11_0.c:95-143 (sos only) vs psp_v3_1.c:126-143 and psp_v10_0.c:126-143 (asd loaded) vs upstream v5.2 psp_v11_0.c (asd loaded); consumption: amdgpu_psp.c:291 (psp_hw_start -> psp_asd_load), amdgpu_psp.c:254-255 (memcpy NULL/0 + zero-len LOAD_ASD), amdgpu_psp.c:137-142 (resp.status ignored when ucode==NULL). Guest untestability: pciconf -l shows vgapci0 chip=0x11111234 (QEMU/bochs) and virtio devices only.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/psp_v11_0.c:95-143",
    "sys/dev/drm/amd/amdgpu/amdgpu_psp.c:238-266",
    "sys/dev/drm/amd/amdgpu/amdgpu_psp.c:268-296",
    "sys/dev/drm/amd/amdgpu/amdgpu_psp.c:137-142",
    "sys/dev/drm/amd/amdgpu/psp_v3_1.c:126-143",
    "sys/dev/drm/amd/amdgpu/psp_v10_0.c:126-143"
  ],
  "poc_changes": "No PoC authored: the finding requires Vega20 (AMD) hardware for any runtime manifestation; the guest has none (verified via pciconf).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "untested = skipped per contract (Low severity, requires absent Vega20 HW; allowed status set has no not_testable/skipped). Guest evidence of untestability captured (pciconf: no AMD PCI device). The error-swallowing half of this chain is the already-filed amdgpu_psp.c DF-4768 flaw; the new part filed here is the v11 ASD init divergence itself.",
  "recommended_fix": "Load amdgpufw_vega20_asd in psp_v11_0_init_microcode mirroring psp_v3_1 (see fix.diff), or alternatively skip psp_asd_load when psp->asd_fw == NULL",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (mirrors psp_v3_1 ASD block; git-apply clean vs sys/) but cannot be runtime-validated without Vega20 hardware",
  "fix_evidence": "findings/poc/DF-4785/fix.diff"
}