⬢ DragonFlyBSD Kernel Audit
DF-4873 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-4873",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel heap memory leak (permanent, ~1KB per failed attach) on the ar9287 EEPROM-attach error paths: ath_hal_9287EepromAttach mallocs HAL_EEPROM_9287 at ah_eeprom_9287.c:322 (ath_hal_malloc -> kmalloc M_ATH_HAL M_ZERO, ah_osdep.c:121-124), then returns HAL_EEREAD at :335 (mid-image read failure), HAL_EEBADSUM at :376 (bad checksum) or :395 (bad EEPROM version) without freeing ee and without installing it - AH_PRIVATE(ah)->ah_eeprom and the ah_eepromDetach op are set only at :400-406, after every error return. The callers unwind (ar9287_attach.c:239-241 goto bad -> ah->ah_detach == ar5416Detach, ar5416_attach.c:490-509) calls ath_hal_eepromDetach at :507, which is a no-op when ah_eepromDetach was never installed (ah_internal.h:474-477), then ath_hal_free frees only the ath_hal itself. The HAL_EEPROM_9287 is orphaned with no back-reference. Attacker model (untrusted EEPROM / hostile card, physical access or hotplug): a corrupt or reprogrammed EEPROM trivially hits checksum/version failure; every attach attempt leaks ~1KB; hotplug cycles repeat it without bound (slow kernel memory exhaustion). Same shape as DF-4209 (legacy eeprom leak, Info) but attacker-chosen trigger content and hotplug-repeatable. Statically certain: allocation -> error return -> caller unwind -> detach macro no-op, no gap. No AR9287 NIC on the QEMU guest so no runtime PoC (family precedent DF-4793/DF-4799/DF-4548 untested). v14EepromAttach (ah_eeprom_v14.c:363+) and v4k have the identical family bug - fix them the same way.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4873/VERDICT.md (full ownership trace with path:line); findings/poc/DF-4873/fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:239-241",
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_attach.c:362-367",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.c:322-326",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.c:331-336",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.c:373-377",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.c:392-396",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_9287.c:400-406",
    "sys/dev/netif/ath/ath_hal/ah_internal.h:474-477",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_attach.c:490-509",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:121-124"
  ],
  "poc_changes": "No runtime PoC possible: requires an AR9287 card whose EEPROM fails mid-read/checksum/version; no Atheros NIC on the QEMU guest. Verification is the complete static ownership trace in VERDICT.md",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Anchored at the audited files call site (ar9287_attach.c:239) with root cause in ah_eeprom_9287.c - v14/v4k eeprom attach twins carry the same bug and should be fixed identically (fail: label + ath_hal_free). | Guest runtime-checked: pciconf shows NO Atheros PCI device (ar9287Attach unreachable), confirming hardware-bound untested status.",
  "recommended_fix": "Add a fail: label to ath_hal_9287EepromAttach that ath_hal_free()s the not-yet-installed ee, and route the three post-malloc error returns through it (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate root cause and verified git-apply-able; runtime fix validation impossible on the guest (no AR9287 hardware to trigger a failed eeprom attach)",
  "fix_evidence": "findings/poc/DF-4873/fix.diff"
}