⬢ DragonFlyBSD Kernel Audit
DF-4847 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-4847",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced at feeder level on the audit guest against the real, unmodified sys/dev/sound/pcm/feeder_matrix.c: feed_matrix_feed() sizes its pass with the inexact generated SND_FXROUND/SND_FXDIV macros (shared table defect with DF-4846: misround-up within [1,65536] from x~4.7K-8.2K for non-pow2 aligns). :479 FXROUND(count,oalign) can exceed the callers count (pass sized past the window); :501 FXROUND(count-oalign,ialign) can make j>count so src=dst+count-j lands BEFORE the window and the source window exceeds the destination; :509 FXDIV of a partial user-paced return miscounts frames. Harness: 4891/23706 checks fail with canary-guard hits (e.g. 2ch->6ch upmix, count=8195, FXROUND(8195,12)=8196, write past window); with the fixed generator header 0 failures. The previous pass-2 soak (220k iterations) did not drive the bad-residue counts - the defect is deterministic arithmetic. Reachability: feeder_build_matrix on any channel-count mismatch (feeder_chain.c:284-336), unprivileged SNDCTL_DSP_CHANNELS, default chain; counts user-paced via buffer.c:705-709. In-kernel churn: no differential anomaly vs aligned control on this no-INVARIANTS kernel (logs in DF-4849 pack), as expected for <=ialign-1-byte writes plus silent ring overflow. Impact ceiling: kernel heap OOB write past tmpbuf at exact-page allocation geometry + sndbuf ring invariant breakage, unprivileged, default config.",
  "exploit_chain": "",
  "evidence": "mat.log (baseline: checks=23706 failures=4891, REAR-guard hits with exact counts); mat_fixed.log (fixed table: failures=0 ALL PASS); ffmat.c/fxshim.h/fxsrc.c (harness compiling the pristine feeder_matrix.c with real headers and the real generated table); VERDICT.md",
  "kernel_refs": [
    "sys/dev/sound/pcm/feeder_matrix.c:479",
    "sys/dev/sound/pcm/feeder_matrix.c:494-506",
    "sys/dev/sound/pcm/feeder_matrix.c:501",
    "sys/dev/sound/pcm/feeder_matrix.c:509",
    "sys/dev/sound/pcm/feeder_chain.c:284-336",
    "sys/dev/sound/pcm/buffer.c:705",
    "sys/dev/sound/pcm/buffer.c:708-712",
    "sys/dev/sound/pcm/buffer.c:615-636",
    "sys/tools/sound/snd_fxdiv_gen.awk:56-71"
  ],
  "poc_changes": "Fresh harness (DF-4846 infrastructure); source pattern lowered to tiny amplitudes so the files own FEEDMATRIX_CLIP_CHECK errx diagnostic never terminates the run.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "cd /root/fx && sh build.sh; cc -O1 -g -o ffmat ffmat.c fxsrc.c",
  "run_cmd": "./ffmat   # baseline FAIL; cp snd_fxdiv_gen_fixed.h snd_fxdiv_gen.h; rebuild -> ALL PASS",
  "code_hash": "",
  "notes": "Supersedes this files pass-2 clean soak: that soak did not enumerate the FXDIV bad-residue counts. Shared root cause with DF-4846/4848/4849; one generator fix clears all four.",
  "recommended_fix": "Fix snd_fxdiv_gen.awk (domain-exact reciprocals + 64-bit multiply, fix.diff); optionally clamp count in feed_matrix_feed to the callers window.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "A/B at harness level, only the generated header swapped: 4891 failures vs 0 (mat.log vs mat_fixed.log). Kernel rebuild A/B not performed (null in-kernel baseline observable on this rig, same standard as DF-4710).",
  "fix_evidence": "mat_fixed.log (failures=0); fix.diff; snd_fxdiv_gen_fixed.awk"
}