⬢ DragonFlyBSD Kernel Audit
DF-4843 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-4843",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Not run on the audit guest (requires a Tonga/Vega10 GPU or an adev fake with stubbed set_rptr MMIO; the guest has no GPU). Code-certain by inspection: tonga_ih_get_wptr (tonga_ih.c:196-219) returns the device-DMAd writeback wptr with only a ptr_mask - no alignment check - and amdgpu_ih_process (amdgpu_ih.c:154-165) walks the ring with rptr advancing strictly in 16-byte steps and restart_ih re-reading the same wptr. A wptr not a multiple of 16 can never equal rptr, so the ithread laps the 64KiB ring forever re-dispatching entries with ih->lock held: permanent interrupt-thread hard-spin (one CPU pegged, all GPU interrupts dead). Hostile/faulting-device DoS only; no memory-safety issue on this path (entry reads masked+bounded, src_id/client_id checked in dispatch).",
  "exploit_chain": "",
  "evidence": "README.md (loop-lap argument with path:line); trigger_sketch.c",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/tonga_ih.c:196",
    "sys/dev/drm/amd/amdgpu/tonga_ih.c:218",
    "sys/dev/drm/amd/amdgpu/tonga_ih.c:245",
    "sys/dev/drm/amd/amdgpu/tonga_ih.c:277",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:163"
  ],
  "poc_changes": "sketch only; no runnable PoC without hardware",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Device-gated DoS in the hostile/faulting-GPU threat model the batch asked to hunt. fix.diff intentionally omitted per policy for untested findings.",
  "recommended_fix": "validate wptr alignment in tonga_ih_get_wptr (reject/repair wptr & ~0xf mismatch with a ring reset) and cap per-invocation entry count in amdgpu_ih_process so a storm or bad wptr cannot hard-spin the ithread"
}