⬢ DragonFlyBSD Kernel Audit
DF-4869 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4869",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent, mostly-dead defects in mps_table.c (twin of DF-4790): (1) mps_print_evt_sas walks data->PHY[i] for firmware-supplied NumEntries (u8, up to 255 x 4-byte entries, mps_table.c:332-345) with no EventDataLength bound \u2014 the buffer is the reply frame itself (mps.c:1530-1543, ReplyFrameSize*4 bytes per frame, mps.c:718), so the walk can read ~1KB past a ~96-128-byte frame; unlike the mpr twin this function IS live (mpssas_evt_handler, mps_sas_lsi.c:131, every SAS event) but every read is inside mps_dprint_field gated on sc->mps_debug & MPS_EVENT (mpsvar.h:609/:628-632, default 0, root-set sysctl) \u2014 same live-but-gated class as pass-1 DF-4560; (2) mps_print_sasdev0 (mps_table.c:259), mps_print_expander1 (:383) and mps_print_sasphy0 (:423) have zero callers tree-wide \u2014 dead config-page printers that would parse unvalidated fw-sized pages if resurrected; (3) mps_describe_table returns table[i+1].string, one entry past the {NULL,0} sentinel (mps_table.c:72) \u2014 in-bounds today only because all nine in-file tables ship an extra Unknown entry. No reachable path, nothing to execute on the audit guest (no MPT2 hardware, env.txt); filed as Info so the patterns are not resurrected as-is.",
  "exploit_chain": "",
  "evidence": "README.md (liveness + line cites), VERDICT.md (grep evidence of dead callers + gating analysis), env.txt (guest has no vendor 0x1000 device), fix.diff (NumEntries bound + literal fallback + missing break)",
  "kernel_refs": [
    "sys/dev/raid/mps/mps_table.c:63",
    "sys/dev/raid/mps/mps_table.c:72",
    "sys/dev/raid/mps/mps_table.c:332",
    "sys/dev/raid/mps/mps_table.c:377",
    "sys/dev/raid/mps/mps_table.c:259",
    "sys/dev/raid/mps/mps_table.c:383",
    "sys/dev/raid/mps/mps_table.c:423",
    "sys/dev/raid/mps/mps_sas_lsi.c:131",
    "sys/dev/raid/mps/mps.c:1533",
    "sys/dev/raid/mps/mpsvar.h:628"
  ],
  "poc_changes": "no PoC produced \u2014 dead/latent code, no trigger path exists (and no MPT2 hardware on the guest)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Preferred fix for the dead printers is deletion; fix.diff shows the minimal bounds if kept. Missing break at mps_table.c:377 is benign (falls into default: break). Delta vs DF-4790: mps_print_evt_sas is live-but-gated (mprs was fully dead), so the NumEntries bound matters slightly more here.",
  "recommended_fix": "Delete the dead mps_print_* debug printers, bound NumEntries by EventDataLength, and use a literal fallback in mps_describe_table",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "dead/latent code \u2014 nothing to validate on the guest; the diff is a defensive bound plus cleanup only",
  "fix_evidence": "findings/poc/DF-4869/fix.diff"
}