⬢ DragonFlyBSD Kernel Audit
DF-4872 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-4872",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Hardware-bound caps/regulatory defect, no memory corruption in this file: ar9287FillCapabilityInfo (ar9287_attach.c:433) inherits ar5416FillCapabilityInfo, whose GMODE block (ar5416_attach.c:904-915) unconditionally ORs HAL_MODE_11A|11NA_HT20|11NA_HT40+|11NA_HT40- into halWirelessModes whenever the EEPROM 11G opflag is set (true on every functional 11g card, polarity verified uniform in v14/v4k/9287 eeprom layers) even though the 9287 EEPROM layer explicitly denies AR_EEP_AMODE (no 5GHz for Kiwi, ah_eeprom_9287.c:73-74); 5GHz edges 4915/6100 are set unconditionally (ar5416_attach.c:920-921). The override block (ar9287_attach.c:435-466) sets ~20 caps fields but never clamps halWirelessModes or the 5GHz edges. halWirelessModes is the sole hardware gate admitting 11A/11NA cmodes in getchannels (ah_regdomain.c:398-416 cm->mode & modesAvail), so an EEPROM regDmn[0] (taken unvalidated at ar9287_attach.c:334-335) with 5GHz entries yields 5GHz channels on 2GHz-only silicon; selecting one hits the already-filed DF-4793 NULL-pier panic in ar9287SetPowerCalTable or programs the RF from 2GHz-only cal data (ar9287 EEPROM image has no 5GHz structures, ah_eeprom_9287.h:135-153). Exact DF-4799 (ar9285) twin shape; unlike ar9287, nf_5g IS populated here (ar9287_attach.c:353-355). Static chain verified hop-by-hop; no AR9287 NIC on the QEMU guest, so untested at runtime per family precedent (DF-4793/DF-4799/DF-4548).",
  "exploit_chain": "stock 11g opflag (or attacker-reprogrammed EEPROM, checksum recomputed) -> GMODE divergence adds 11A/11NA to halWirelessModes despite AMODE denial -> ar9287FillCapabilityInfo never clamps; 5GHz edges inherited -> ath_getradiocaps HAL_MODE_ALL (if_ath.c:6082) -> getchannels modesAvail gate passes 11A/11NA + EEPROM regdomain rd5GHz bitmaps -> 5GHz channels in ic_channels on 2GHz-only silicon -> channel switch -> DF-4793 NULL pier-list panic in ar9287SetPowerCalTable (or uncalibrated out-of-band radio programming)",
  "evidence": "findings/poc/DF-4872/VERDICT.md (full static chain with path:line at every hop); findings/poc/DF-4872/fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:433",
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:429-469",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_attach.c:904-915",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_attach.c:920-921",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.c:73-79",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.h:135-153",
    "sys/dev/netif/ath/ath_hal/ah_regdomain.c:398-416",
    "sys/dev/netif/ath/ath/if_ath.c:6073-6084",
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_reset.c"
  ],
  "poc_changes": "No runtime PoC possible: trigger hardware (AR9287 Kite-2 PCIe NIC + its EEPROM) absent from the QEMU guest; verification is the static line-by-line chain in VERDICT.md",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding on the attach side; the crash site itself is DF-4793 (ar9287_reset.c, filed). This is the ar9287 twin of DF-4799 (ar9285). Recommended companion fix: drop the 11A/11NA OR-block from the ar5416 GMODE branch (ar5416_attach.c:910-914) so 5GHz modes only ever come from the AMODE branch. | Guest runtime-checked: pciconf shows NO Atheros PCI device (ar9287Attach unreachable), confirming hardware-bound untested status.",
  "recommended_fix": "In ar9287FillCapabilityInfo, immediately after ar5416FillCapabilityInfo succeeds, mask HAL_MODE_11A|TURBO|108A|11A_HALF|11A_QUARTER|11NA_HT20|11NA_HT40PLUS|11NA_HT40MINUS out of halWirelessModes and zero halLow5GhzChan/halHigh5GhzChan (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate root cause and verified git-apply-able; runtime fix validation impossible on the guest for the same reason the PoC is untested (no AR9287 hardware)",
  "fix_evidence": "findings/poc/DF-4872/fix.diff"
}