⬢ DragonFlyBSD Kernel Audit
DF-4826 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4826",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The dead-code claim reproduced on every axis: amdgpu_acp.c is absent from the amdgpu Makefile SRCS, its required shim headers (linux/pm_domain.h, sound/designware_i2s.h, sound/pcm.h) do not exist anywhere in sys/dev/drm/include, CONFIG_DRM_AMD_ACP is never defined (so adev->acp and the vi.c acp_ip_block registrations are compiled out), no mfd_*/pm_genpd_*/bus_find_device_by_name implementation exists in the tree, and the shipped guest /boot/kernel/amdgpu.ko contains zero ACP symbols (positive control amdgpu_acpi: 17 matches). Conclusion: DF-1907, DF-1908, DF-1909 and DF-1910 are latent vendored-source defects that cannot execute on DragonFly as shipped; they should be re-triaged as deferred/latent rather than live Medium/Low findings.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4826/run.log \u2014 all five verdict inputs: [1] Makefile grep amdgpu_acp.c -> none (amdgpu_acpi.c:168 positive control), [2] pm_domain.h/designware_i2s.h/pcm.h ABSENT, [3] CONFIG_DRM_AMD_ACP zero definitions / five ifdef consumers, [4] zero shim implementations for mfd_add_hotplug_devices/mfd_remove_devices/pm_genpd_init/pm_genpd_add_device/bus_find_device_by_name, [5] guest nm amdgpu.ko ACP symbol count 0 vs acpi count 17",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/Makefile:53-347",
    "sys/dev/drm/amd/amdgpu/amdgpu_acp.c:26",
    "sys/dev/drm/amd/amdgpu/amdgpu_acp.c:29",
    "sys/dev/drm/amd/amdgpu/amdgpu.h:823",
    "sys/dev/drm/amd/amdgpu/vi.c:74",
    "sys/dev/drm/amd/amdgpu/vi.c:1685",
    "sys/dev/drm/amd/amdgpu/vi.c:1706",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:667",
    "sys/dev/drm/include/linux/platform_device.h:36",
    "sys/dev/drm/include/linux/mfd/core.h:31"
  ],
  "poc_changes": "n/a \u2014 pass-2 originated; PoC authored fresh (check_dead.sh), no seed existed",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1: Mon Jun 29 14:18:01 UTC 2026  root@ephemeral-5c2002c44b6c:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-4826/build.sh (include-resolution gate; no host compiler \u2014 fact proven by header absence)",
  "run_cmd": "sh findings/poc/DF-4826/run.sh",
  "code_hash": "70a8b703d1ab13aa6aae9c496ccaf18a9915f2e6e8da3d7c21fbcd74cb1bcc1c",
  "notes": "Guest left up and clean (read-only checks: grep/find/nm only). No fix.diff: reachability refutation, nothing to patch in sys/ \u2014 the code is not built. Additional latent error-path defects documented in VERDICT.md (post-pm_genpd_init kcalloc-failure dangling acp_cell/acp_res in hw_fini; -ETIMEDOUT paths skipping teardown) \u2014 all unreachable for the same dead-TU reason, not filed separately. Wait loops proven bounded (0xFF x udelay(100)), killing the infinite-wait hypothesis.",
  "recommended_fix": "Re-triage DF-1907/DF-1908/DF-1909/DF-1910 as deferred/latent (dead code on DFly); optionally remove amdgpu_acp.c from the vendored tree or finish the mfd/genpd shims before ever wiring CONFIG_DRM_AMD_ACP on.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": null,
  "fix_verdict": "not_applicable \u2014 no kernel code change involved; the finding is a build-membership refutation, so there is no patched-kernel behavior to compare. Mapped to not_testable for the fix_results CHECK constraint.",
  "fix_evidence": "n/a (no fix.diff; see VERDICT.md Fix section)"
}