⬢ DragonFlyBSD Kernel Audit
DF-4985 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
{
  "finding_id": "DF-4985",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-2 depth on the dce110 command-table helper. The file is live code (compiled into the amdgpu kmod, amd/amdgpu/Makefile:217) and its vtable is selected for DCE 10.0/11.0 (Tonga/Fiji/Carrizo) by BOTH parser dispatchers (command_table_helper.c:46,50 v1; command_table_helper2.c:47,51 v2). Five vtable members are NULL (three explicit at :344-346, two implicit: dc_clock_type_to_atom, transmitter_color_depth_to_atom) while six consumer call sites invoke members unguarded (command_table.c:204,219,507,638,678,2437; command_table2.c:722) - a generation-mismatched ASIC/VBIOS pairing would call through NULL and panic display init. Unreachable on genuine hardware, proven by the version matrix: the rev-2/3/4 transmitter and rev<3 encoder handlers that use those members bind only from DCE8-generation VBIOS, whose ASICs select the dce80 table (the only one implementing them, dce80 :341-345); DCE10/11 firmware uses rev 5/6 handlers built only from implemented members; and set_dce_clock is called solely from dce112_set_clock, wired only into dce112/dce120/dcn1 funcs (dce_clocks.c:745,752,758) - DCE10/11 wire dce110_funcs (dce_clocks.c:762-767) which never calls it. Residual trigger requires reflashing the machines own VBIOS (outside the attacker model). Family attribution: DF-2030 (dead return-0) correctly sits on THIS file (:154-189, not re-reported); the DF-4935 uninit-output shape does NOT exist here (no dc_clock_type_to_atom implementation at all - implicit NULL instead); command_table_helper2_dce110 does not exist; all other switches in the file initialize outputs on every path (negative result verified).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4985/VERDICT.md sections 2-4 (the five-member/six-call-site matrix and the generation-lock proof); README.md table; null_matrix_proof.log",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:332-349",
    "sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:344-346",
    "sys/dev/drm/amd/display/dc/bios/command_table_helper_struct.h:34-64",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:204",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:219",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:507",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:638",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:678",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:2437",
    "sys/dev/drm/amd/display/dc/bios/command_table2.c:722",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:367-396",
    "sys/dev/drm/amd/display/dc/bios/dce80/command_table_helper_dce80.c:341-345",
    "sys/dev/drm/amd/display/dc/bios/command_table_helper.c:46,50",
    "sys/dev/drm/amd/display/dc/bios/command_table_helper2.c:47,51",
    "sys/dev/drm/amd/display/dc/bios/bios_parser_interface.c:41-45",
    "sys/dev/drm/amd/display/dc/dce/dce_clocks.c:745-771",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:68-75"
  ],
  "poc_changes": "not applicable - no PoC possible on the audit guest (no AMD GPU, amdgpu never attaches); matrix proven statically",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "pass 2 (GLM 5.3). Pass-1 known finding on this file: DF-2030 (dead return-0, :154-189) - not re-reported. DF-4934/4935/4936/4937 cover the dce112 twins; dce80 implements the members dce110 NULLs (generation-locked design). This completes the command_table_helper family sweep (dce80 pass-1, dce110 pass-1+2, dce112 v1+v2 pass-2).",
  "recommended_fix": "Defense-in-depth: reuse the shared dal_cmd_table_helper_* implementations for the three explicit-NULL members (as dce80 does) and add a dc_clock_type_to_atom with initialized default, or NULL-guard the six consumer call sites.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable - requires AMD DCE10/11 hardware with mismatched VBIOS; audit guest has no AMD GPU",
  "fix_evidence": ""
}