⬢ DragonFlyBSD Kernel Audit
DF-4861 / verdict.json
← back to finding ↓ download raw
{"finding_id":"DF-4861","status":"untested","attempts":0,"reproduced":0,"impact":"panic","confidence":"certain","verdict":"Latent dead-API hardening (zero callers tree-wide today): struct aux_engine_funcs declares .configure but the dce110 (and every i2caux) func table leaves it NULL via designated-initializer semantics, while the exported dal_i2caux_configure_aux() calls it unconditionally at i2caux.c:306 - a guaranteed NULL function-pointer panic the moment any future display-reconfig path uses the API (serves DCE 8.x-11.2 ASICs). No AMD GPU on guest. Guard-the-call (or stub) fix.","exploit_chain":"any future caller of dal_i2caux_configure_aux on DCE8-11.2 -> engine->funcs->configure == NULL -> kernel panic","evidence":"findings/poc/DF-4861/ (this verdict)","kernel_refs":["sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:451-459","sys/dev/drm/amd/display/dc/i2caux/i2caux.c:306","sys/dev/drm/amd/display/dc/i2caux/aux_engine.h:38-40"],"guest_uname":"","code_hash":""}