⬢ DragonFlyBSD Kernel Audit
DF-4809 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4809",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Static NULL-deref, not guest-verified (no runnable trigger): ata_dmaalloc() failure leaves ch->dma == NULL (ata-dma.c:152-153) but channel attach continues; ata_attach -> ATA_RESET -> ata_pcichannel_reset (ata-pci.c:850-851) invokes ctlr->reset with no NULL guard, and ata_ahci_reset immediately dereferences ch->dma->work_bus (ata-ahci.c:466-469) -> attach/reinit-time kernel panic (CWE-476) under DMA-coherent memory exhaustion. Every sibling path guards with if (ch->dma) (ata-pci.c:791, 811, 842). Severity Low: boot/hot-plug DoS only, no attacker-controlled data.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4809/VERDICT.md (full path trace with path:line citations); findings/poc/DF-4809/fix.diff (one-line guard)",
  "kernel_refs": [
    "sys/dev/disk/nata/chipsets/ata-ahci.c:466",
    "sys/dev/disk/nata/chipsets/ata-ahci.c:467",
    "sys/dev/disk/nata/ata-dma.c:149",
    "sys/dev/disk/nata/ata-dma.c:152",
    "sys/dev/disk/nata/ata-pci.c:790",
    "sys/dev/disk/nata/ata-pci.c:842",
    "sys/dev/disk/nata/ata-pci.c:850",
    "sys/dev/disk/nata/ata-all.c:126"
  ],
  "poc_changes": "not applicable (no seed PoC; finding produced by pass-2 static analysis)",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the same if (ch->dma == NULL) return; guard used by sibling paths; not build-validated because the trigger condition (DMA alloc failure) cannot be produced on the guest",
  "fix_evidence": "findings/poc/DF-4809/fix.diff",
  "notes": "Phase V skipped per contract: Low severity, no trivially runnable local PoC (trigger = bus_dmamem_alloc failure at attach). QEMU guest not used for this finding.",
  "recommended_fix": "Guard ata_ahci_reset work-area setup with if (ch->dma == NULL || ch->dma->work_bus == 0) return; after the port-implemented check"
}