⬢ DragonFlyBSD Kernel Audit
DF-4813 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4813",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static NULL-deref with complete path proof, not guest-runnable (no Marvell 88SX device exists under QEMU and a PCI storage controller cannot be injected like an ACPI table): ata_dmaalloc() failure leaves ch->dma == NULL (ata-dma.c:152-153) but channel attach continues (framework supports PIO-only, guarding every other ch->dma use at ata-pci.c:795/799/816/843); ata_pcichannel_attach then calls ctlr->allocate(dev) UNCONDITIONALLY (ata-pci.c:798) and ata_marvell_edma_allocate immediately dereferences ch->dma->work_bus (ata-marvell.c:209) and ch->dma->work/work_tag/work_map (211-213) -> attach/boot-time kernel panic (CWE-476) under DMA-coherent memory exhaustion on any 88SX50xx/60xx/6042/7042 EDMA system. Marvell is the only nata chipset whose ->allocate derefs ch->dma (ahcis allocate does not \u2014 its deref was in reset, DF-4809). Fix compile-validated on the audit guest: guard applied, natapci.ko rebuilt clean with -Werror (fix_build.log, build_rc=0).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4813/VERDICT.md (full path:line trace); findings/poc/DF-4813/fix.diff; findings/poc/DF-4813/fix_build.log (clean -Werror module build with the guard)",
  "kernel_refs": [
    "sys/dev/disk/nata/chipsets/ata-marvell.c:209",
    "sys/dev/disk/nata/chipsets/ata-marvell.c:211",
    "sys/dev/disk/nata/chipsets/ata-marvell.c:212",
    "sys/dev/disk/nata/ata-pci.c:795",
    "sys/dev/disk/nata/ata-pci.c:798",
    "sys/dev/disk/nata/ata-dma.c:152",
    "sys/dev/disk/nata/ata-dma.c:153",
    "sys/dev/disk/nata/ata-chipset.c:160"
  ],
  "poc_changes": "not applicable (no seed PoC; pass-2 static finding; dynamic trigger requires physical 88SX hardware)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the same if (ch->dma == NULL) return ENXIO; guard the framework itself uses; compile-validated on the audit guest (natapci.ko rebuilt clean with -Werror). Behavioral validation impossible on QEMU: no 88SX device, and ata_dmaalloc failure cannot be produced without the real attach.",
  "fix_evidence": "findings/poc/DF-4813/fix.diff; findings/poc/DF-4813/fix_build.log",
  "build_cmd": "cd /usr/src/sys/dev/disk/nata/natapci && make obj && make   (fix compile-validation)",
  "run_cmd": "n/a (requires 88SX50xx/60xx/6042/7042 hardware hitting an ata_dmaalloc failure at channel attach)",
  "code_hash": "a838e64ebcd61bad83bca2ddda798fa8dff804af69ef3b25bc4cfd8d947a2217",
  "notes": "Same class as accepted DF-4809 (ata-ahci reset); here the deref is in ->allocate. Driver is live code: ata-chipset.c:159-160 #includes chipsets/ata-marvell.c into natapci (ATA_NO_MARVELL not set). PATA 61xx path is safe (goes through ata_pci_allocate which never touches ch->dma).",
  "recommended_fix": "Guard ata_marvell_edma_allocate with if (ch->dma == NULL) return ENXIO; before the first ch->dma dereference (ata-marvell.c:209)"
}