โฌข DragonFlyBSD Kernel Audit
DF-4886 / trigger_sketch.c
โ† back to finding โ†“ download raw
/*
 * DF-4886 trigger sketch (NOT runnable โ€” no powerplay GPU on the audit guest).
 *
 * The bug: phm_start_thermal_controller() is the sole public phm_* wrapper in
 * hardwaremanager.c that omits PHM_FUNC_CHECK. To fire it you need a pp_hwmgr
 * whose hwmgr_func is NULL and pm_en true โ€” no in-tree chip path produces that
 * state today (see README.md "Why latent"), so this sketch models the minimal
 * kernel-side harness that WOULD panic if that state ever existed:
 *
 *	struct pp_hwmgr hwmgr = { .pm_en = true, .hwmgr_func = NULL };
 *	phm_start_thermal_controller(&hwmgr);
 *		-> hardwaremanager.c:240 reads hwmgr.hwmgr_func->get_thermal_temperature_range
 *		   at offset ~0x?? of NULL  =>  kernel NULL-deref panic.
 *
 * Equivalent live precursor (already filed): hwmgr_hw_init's own unguarded
 * deref at hwmgr.c:216 (DF-1913) fires even earlier on the same state.
 *
 * Build/run: kernel-internal; no userspace trigger exists. Recorded as a
 * static latent finding โ€” verdict "untested", attempts 0.
 */
int df4886_unused_trigger_placeholder;