⬢ DragonFlyBSD Kernel Audit
DF-4906 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4906",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "speculative",
  "verdict": "Code defect is certain: READ_PENDING_WAIT (powernow.c:84-87) is an unbounded do/while over rdmsr(0xc0010042) used at all five transition wait points (powernow.c:263,275,293,299,306); a stuck change-pending bit pegs one CPU at 100% in unkillable kernel context (sysctl writer never sleeps or checks signals; the module-load path wedges kldload). The driver comment at powernow.c:235-238 even names the hazard (need to ensure that the change pending bit isnt stuck) yet every wait is unbounded; Linux powernow-k8 checks once and returns -EIO. Trigger requires misbehaving K8 silicon/firmware (erratum, wedged PLL, incomplete VM MSR emulation) plus a frequency transition (root sysctl write or the module-load setperf), hence speculative impact on this hardware base; untestable on the Intel/QEMU guest (module CPUID gate refuses, MOD_LOAD error 2, env.txt).",
  "exploit_chain": "",
  "evidence": "README.md (macro + five call sites), env.txt (gate refusal), VERDICT.md",
  "kernel_refs": [
    "sys/dev/powermng/powernow/powernow.c:84",
    "sys/dev/powermng/powernow/powernow.c:263",
    "sys/dev/powermng/powernow/powernow.c:293",
    "sys/dev/powermng/powernow/powernow.c:299",
    "sys/dev/powermng/powernow/powernow.c:306",
    "sys/dev/powermng/powernow/powernow.c:235"
  ],
  "poc_changes": "Analysis-only pack; triggering needs K8 hardware with a stuck pending bit.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not run (needs K8 hardware with stuck pending bit). fix.diff converts the macro to a bounded DELAY(1) loop and applies cleanly with patch(1).",
  "fix_evidence": "fix.diff: checking file powernow.c / DF4906_APPLIES_CLEAN",
  "recommended_fix": "Bound READ_PENDING_WAIT (e.g. 1,000,000 iterations with DELAY(1)) and abort the transition on timeout.",
  "notes": "Robustness/DoS hardening consistent with the drivers own comment at powernow.c:235-238."
}