⬢ DragonFlyBSD Kernel Audit
DF-4874 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-4874",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "afd_detach() frees the afd_softc while afd_strategy()/afd_done() can still be running against it, and while disk_invalidate() frees dp->d_slice under concurrent dscheck() \u2014 a byte-for-byte structural twin of DF-4797 (ad), which was REPRODUCED 2/2 on this guest with fatal trap 12. In-situ verification of the afd copy is blocked: QEMU 7.2 has no ATAPI direct-access (floppy-class) emulation, so no afd device can attach; the DF-4797-style trigger was nonetheless built and loaded on the guest and recorded the blocker (afd0 device_t is NULL).",
  "exploit_chain": "open /dev/afd0 (group operator) and raw-pread storm to hold in-flight afd_strategy requests; concurrently device_detach(afd0) (hot-unplug/devctl/kldunload) -> disk_invalidate frees d_slice under dscheck (fatal trap 12, fault 0xc \u2014 the exact DF-4797 in-situ signature) or async taskqueue completion runs afd_done after kfree(fdp) -> devstat_end_transaction_buf(&NULL->stats) UAF write / biodone on destroyed disk",
  "evidence": "VERDICT.md (full trace); run.log (guest: df4874: afd0 device_t is NULL + storm total_io=0); build.log (KLD+storm built on guest); findings/poc/DF-4797/ (reproduced twin, panic.txt 2/2)",
  "kernel_refs": [
    "sys/dev/disk/nata/atapi-fd.c:134",
    "sys/dev/disk/nata/atapi-fd.c:144",
    "sys/dev/disk/nata/atapi-fd.c:148",
    "sys/dev/disk/nata/atapi-fd.c:153",
    "sys/dev/disk/nata/atapi-fd.c:154",
    "sys/dev/disk/nata/atapi-fd.c:313",
    "sys/dev/disk/nata/atapi-fd.c:319",
    "sys/dev/disk/nata/atapi-fd.c:321",
    "sys/dev/disk/nata/atapi-fd.c:329",
    "sys/dev/disk/nata/ata-queue.c:518",
    "sys/dev/disk/nata/ata-queue.c:565",
    "sys/kern/subr_diskslice.c:348"
  ],
  "poc_changes": "Ported the proven DF-4797 detach KLD + storm to the afd devclass (devclass_find(\"afd\"), /dev/afd0); no other changes",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "make -m /usr/share/make KMODDIR=/root/poc/DF-4874 && cc -O2 -pthread -o df4874_storm df4874_storm.c",
  "run_cmd": "kldload ./df4874.ko; sysctl kern.df4874.run=1; ./df4874_storm 16 25",
  "code_hash": "629b2b389cd3c57124194d2b67102cad20fc56385deb297448a8496bc549d264",
  "notes": "Hard blocker documented on-guest: afd driver compiled into X86_64_GENERIC but zero ATAPI direct-access devices possible under QEMU 7.2 (only ide-hd/ide-cd). Guest left clean (kld unloaded).",
  "recommended_fix": "Port the validated DF-4797 fix: EBUSY while disk open, AFD_F_DETACHING under ch->queue_mtx, in-flight refs drained before kfree, ata_fail_requests moved before disk_invalidate/destroy",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline untriggerable on guest (no afd hardware) so no A/B run; fix.diff is a direct port of DF-4797s fix.diff whose own patched-kernel validation passed (findings/poc/DF-4797/run.fixed.log)",
  "fix_evidence": "fix.diff (git apply --check OK); findings/poc/DF-4797/run.fixed.log for the twin validation"
}