⬢ DragonFlyBSD Kernel Audit
DF-4889 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4889",
  "status": "untested",
  "reproduced": 0,
  "impact": "Out-of-bounds device-memory (MMIO) access from a short BAR0: kernel page-fault panic or up to ~12KB bulk zero-write past the resource mapping, before the magic read-back check; requires crafted/broken PCIe hardware with the probed Intel/ICP IDs (CWE-125/CWE-787 device-memory variant)",
  "confidence": "certain",
  "verdict": "Source-verified, hardware-gated: iir_pci_attach never validates rman_get_size(io) against the MPR layout size GDT_PCINEW_SZ (0x4000) yet touches fixed offsets 0x2c..0x3fc0 - the very first access (GDT_MPR_MAGIC write/read at offset 0x1000, iir_pci.c:223-231) and the GDT_MPR_SZ region clear at iir_pci.c:232-233 run past a short BAR. The write at :223 precedes the read-back check, so a writable page following a short mapping is corrupted before the card is rejected. Not runnable on the audit guest: no matching controller in pciconf (env.txt); driver compiled into the kernel (kldstat -v: 100 pci/iir).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4889/VERDICT.md (offset math incl. 0x1000..0x3FC0 region clear); findings/poc/DF-4889/fix.diff; guest hardware-absence proof in findings/poc/DF-4889/env.txt",
  "kernel_refs": [
    "sys/dev/raid/iir/iir_pci.c:186",
    "sys/dev/raid/iir/iir_pci.c:223",
    "sys/dev/raid/iir/iir_pci.c:225",
    "sys/dev/raid/iir/iir_pci.c:232",
    "sys/dev/raid/iir/iir.h:101"
  ],
  "poc_changes": "no runnable PoC (hardware absent); evidence pack documents the offset math and fix",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Physical/supply-chain trigger (evil or counterfeit PCIe device) - hence Low, consistent with DF-4172s band. The magic read-back only protects against cards whose short-BAR neighbor page is unmapped or reads back garbage; it cannot protect against the write at :223 having already landed.",
  "recommended_fix": "Reject attach when rman_get_size(io) < GDT_PCINEW_SZ immediately after mapping BAR0 (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored post-verification against the read-only sys/ tree; not build-validated (no controller hardware)",
  "fix_evidence": "findings/poc/DF-4889/fix.diff"
}