⬢ DragonFlyBSD Kernel Audit
DF-4917 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-4917",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "amdgpu_virt.c:435-439 computes the vf2pf message checksum with length pf2vf_size (host-controlled, (0,4096)) instead of sizeof(amdgim_vf2pf_info) (1024). The byte-sum loop (amdgpu_virt.c:383-384) then reads up to ~3KB past the 1KB vf2pf struct - past the exchange area and, with a tight reservation, off the kmap - and the checksum published to the host covers the wrong byte range so spec-conformant PFs reject the guests message (silent telemetry/feature-flag breakage on benign hosts). Inherited verbatim from upstream Linux v4.19 (verified against torvalds/linux). Not reproduced on the audit guest: no AMD PCI device, fw_vram_usage.va == NULL, function returns at amdgpu_virt.c:402. Source-level defect certain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (length math + upstream comparison); trigger.md (host-side setup); env.txt (guest pciconf: zero AMD devices)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.c:383",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.c:411",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.c:419",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.c:423",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.c:435",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.h:209",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.h:213"
  ],
  "poc_changes": "No runnable PoC for this guest; pack carries the host-side trigger procedure and source-level proof.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "n/a (SR-IOV VF AMD GPU guest required)",
  "run_cmd": "n/a (see trigger.md)",
  "code_hash": "7ac08719fcee3fe051280d928ac99aa8eb759a4e79989b1d61899364f9e57c3e",
  "notes": "Hardware-gated (no AMD GPU on audit guest). OOB read of VRAM adjacent to the exchange area + protocol checksum corruption; host-fed trigger, no guest-user reachability; Low severity consistent with DF-4755/4756 precedent. Inherited from upstream v4.19 (same pf2vf_size at upstream line 432).",
  "recommended_fix": "Pass sizeof(amdgim_vf2pf_info) instead of pf2vf_size to amdgpu_virt_fw_reserve_get_checksum at amdgpu_virt.c:438 (see VERDICT.md diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix could not be validated: no SR-IOV AMD hardware in the audit guest; the one-line diff restores the intended length trivially.",
  "fix_evidence": "VERDICT.md Recommended fix section contains the git-apply-able diff against amdgpu_virt.c."
}