⬢ DragonFlyBSD Kernel Audit
DF-5003 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5003",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "NOT REPRODUCED end-to-end: entering truephy_attachs no media present branch (truephy.c:171-175) requires an Agere ET1011/ET1011C PHY whose ID registers match (truephy.c:69-73) while BMSR/EXTSR media capability bits read zero -- faulty or malicious hardware-in-the-loop, not emulatable on the QEMU guest (same classification as family siblings DF-4930/DF-4957/DF-4981). The kernel-side sink of the chain is now PROVEN live on this exact kernel by the DF-5001 hub replay: the miibus_mediainit walk (mii.c:238-244) on an EMPTY list -- exactly what truephy.c:171-175+178 leads to -- yields panic(\"ifmedia_set\") with trace ifmedia_set<-miihub_fire<-sysctl and kills the guest (../DF-5001/panic.txt), and the fixed walk survives with ifm_cur non-NULL (../DF-5001/run.2.log). Pass-2 deltas: (1) the DF-4930 leaf-fix pattern (call mii_phy_add_media unconditionally) is a NO-OP for truephy because truephy.c:157 sets MIIF_NOISOLATE and mii_phy_add_medias IFM_NONE fallback is gated on MIIF_NOISOLATE being clear (mii_physubr.c:230-232) -- the working fixes are the DF-5001 hub guard (primary) or an explicit ifmedia_add (this packs fix.diff, like DF-4957s ciphy fix); (2) as the FIRST-attaching PHY on a multi-PHY bus, a zero-cap truephy panics the walk before later PHYs add their media -- also covered by the hub guard. Severity Low: attach-time DoS, hardware-fault precondition, no unprivileged userland trigger, no memory unsafety.",
  "exploit_chain": "",
  "evidence": "../DF-5001/panic.txt (sink panic executed on this kernel: ifmedia_set: no match for 0x0/0xfffffff -> panic, trace ifmedia_set<-miihub_fire<-sysctl_root<-userland_sysctl<-sys___sysctl, guest down), ../DF-5001/run.2.log (fixed walk survives, ifm_cur non-NULL), ../DF-5001/miihub.c (verbatim hub-walk replay), fixcheck-build.log (patched truephy.c compiles under -Werror as KLD source), fix.diff (git apply --check OK), VERDICT.md (full trace truephy.c:163-178 -> mii.c:227-245 -> sys/net/if_media.c:174)",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/truephy.c:163-176",
    "sys/dev/netif/mii_layer/truephy.c:178",
    "sys/dev/netif/mii_layer/truephy.c:157",
    "sys/dev/netif/mii_layer/mii.c:227-245",
    "sys/dev/netif/mii_layer/mii.c:238-244",
    "sys/net/if_media.c:166-174",
    "sys/dev/netif/mii_layer/mii_physubr.c:230-232"
  ],
  "poc_changes": "No new runtime PoC: the sink replay is shared with the DF-5001 hub pack (same terminal path); a truephy-specific replay would only re-execute identical ifmedia statements. Leaf fix authored in the explicit-ifmedia_add style because the mii_phy_add_media fallback is MIIF_NOISOLATE-gated for this driver.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "fix compile-check only: guest /root/df5003chk: make -m /usr/share/mk (see fixcheck-build.log)",
  "run_cmd": "shared sink proof: see ../DF-5001/run.sh (hw.miihub_fire=1 -> panic) and ../DF-5001/run_fix.sh (hw.miihub_fixcheck=1 -> survives)",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Leaf fix.diff (explicit ifmedia_add(IFM_NONE) in the no-media branch) applies cleanly and compiles under -Werror as a KLD source on the guest (fixcheck-build.log); its operative mechanism (fallback entry present -> ifmedia_set matches -> no panic, ifm_cur non-NULL) is validated live by the DF-5001 fixcheck replay. End-to-end exercise requires ET1011 hardware (absent). The DF-5001 hub fix is the recommended family fix and also covers this driver unchanged.",
  "fix_evidence": "fixcheck-build.log (truephyfix.ko linked from patched truephy.c), ../DF-5001/run.2.log (fixcheck survived), fix.diff (git apply --check OK)",
  "notes": "4th leaf of the empty-media family (DF-4930 atphy, DF-4957 ciphy, DF-4981 jmphy). truephy.c is the LAST mii_layer driver audited; the family is now complete. DoS only; no write primitive; no uid=0 route.",
  "recommended_fix": "Apply the DF-5001 hub fix (miibus_mediainit empty-list guard); optionally the leaf fix.diff (explicit IFM_NONE ifmedia_add) for parity with DF-4957."
}