⬢ DragonFlyBSD Kernel Audit
DF-4902 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4902",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Not runnable on the audit guest (no AMD GPU; the wptr comes from device DMA into the writeback slot, iceland_ih.c:192). Code-certain by inspection: iceland_ih_get_wptr (iceland_ih.c:188-208) returns the device-DMAd wptr masked only to the ring (iceland_ih.c:207) with no 16-byte alignment validation, and the RB_OVERFLOW recovery (iceland_ih.c:202) imports the misaligned phase into rptr=(wptr+16)&mask \u2014 byte-identical logic to the filed twins DF-4843 (tonga)/DF-4854 (vega10)/DF-4887 (cik); cz differs only in having no use_bus_addr branch and no IH doorbell (wb-only wptr source, CARRIZO/STONEY per vi.c:1600/1692).",
  "exploit_chain": "hostile/faulting GPU or corrupted firmware DMA writes a misaligned wptr into wb.wb[wptr_offs] -> amdgpu_ih_process (amdgpu_ih.c:154-157) can never match the 16-byte-stepping rptr -> permanent ithread spin, all GPU interrupt delivery dead; with RB_OVERFLOW set and wptr in [0xFFE4..0xFFEF] the recovery parks rptr in [0xFFF4..0xFFFF] -> first decode (iceland_ih.c:253-256) reads up to 12 bytes past the exact-64KiB GTT ring BO, consumed as an interrupt vector",
  "evidence": "VERDICT.md (code-identity argument: byte-identical to cz_ih.c get_wptr/prescreen/decode); trigger_sketch.c (armed pattern with byte arithmetic); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/iceland_ih.c:192",
    "sys/dev/drm/amd/amdgpu/iceland_ih.c:202",
    "sys/dev/drm/amd/amdgpu/iceland_ih.c:207",
    "sys/dev/drm/amd/amdgpu/iceland_ih.c:253",
    "sys/dev/drm/amd/amdgpu/iceland_ih.c:266",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154"
  ],
  "poc_changes": "n/a \u2014 no seed PoC; family-consistent trigger sketch authored",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC (no AMD GPU)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (device-gated)",
  "run_cmd": "n/a (device-gated)",
  "code_hash": "n/a",
  "notes": "5th of 5 IH implementations (iceland = TOPAZ parts, vi.c:1600). Family sweep answer: NONE of cik/tonga/vega10/cz/iceland validates wptr alignment. Discovered during the DF-4901 cz_ih.c audit; iceland_ih.c was marked clean in pass 1 before the family was known. NOTE: iceland_ih.c files row was not part of this batch - flag to orchestrator to re-open/re-bucket it.",
  "recommended_fix": "Mask wptr to 16-byte alignment (with dev_warn) in iceland_ih_get_wptr before the overflow check and derive the recovery rptr from the aligned value; cap the shared walk in amdgpu_ih_process (see DF-4887 fix.diff).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix authored against the read-only sys/ tree (fix.diff); not buildable/testable on this guest (no AMD GPU)",
  "fix_evidence": "findings/poc/DF-4902/fix.diff"
}