⬢ DragonFlyBSD Kernel Audit
DF-5013 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
  "finding_id": "DF-5013",
  "verdict": "not_reproduced (hardware-gated; source-proven end-to-end) / memcorrupt ceiling",
  "impact": "none",
  "confidence": "likely",
  "reproduce": {
    "build": "n/a on this guest (no LSI MegaRAID controller; mfi cannot attach)",
    "run": "n/a; see VERDICT.md for the full source-traced chain and the exploit-chain design",
    "expected": "on real hardware: AEN volume-offline (mfi.c:1494-1510) or MFI_DCMD_LD_DELETE success (mfi.c:2630-2635) frees the mfi_disk softc under an open /dev/mfidN fd and/or in-flight bios -> mfi_disk_complete / strategy deref freed softc"
  },
  "kernel_refs": [
    "sys/dev/raid/mfi/mfi_disk.c:171",
    "sys/dev/raid/mfi/mfi_disk.c:295",
    "sys/dev/raid/mfi/mfi_disk.c:304",
    "sys/dev/raid/mfi/mfi.c:1494",
    "sys/dev/raid/mfi/mfi.c:2633",
    "sys/kern/subr_bus.c:2127",
    "sys/vfs/devfs/devfs_core.c:755"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}