⬢ DragonFlyBSD Kernel Audit
DF-5030 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5030",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ar5312GetMacAddr (sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c:287-309) dereferences the BSP-supplied ah_st as struct ar531x_config* and copies 6 bytes from board->wlanXMac with no NULL check and no AR531X_BD_MAGIC validation; on a MIPS SoC build with missing/corrupt flash board-data this is a wild-pointer kernel read (panic, or 6 bytes of kernel/flash memory exposed as the unprivileged-readable Wi-Fi MAC). However, the file is not compiled into any standard DragonFly build: sys/conf/files and the ath_hal kmod Makefile contain no ar5312 entry, AH_SUPPORT_2316/2317 are defined nowhere, and the shipped ath_hal.ko and static kernel on the audit guest contain zero ar5312 symbols. Info-severity latent defect; Phase V runtime PoC skipped per contract (code unreachable at build time).",
  "exploit_chain": "",
  "evidence": "reachability.log (guest: conf-files-ar5312-count 0, hal-makefile-ar5312-count 0, symbols-ar5312-in-ath_hal.ko 0, symbols-ar5312-in-kernel 0); ar5312_attach.c:287-309; ar5312/ar5312.h:25-30; ah_soc.h:33-35,79-90; sys/conf/files:153-232; VERDICT.md",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c:287",
    "sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c:307",
    "sys/dev/netif/ath/ath_hal/ar5312/ar5312.h:25",
    "sys/dev/netif/ath/ath_hal/ah_soc.h:35",
    "sys/dev/netif/ath/ath_hal/ah_soc.h:79",
    "sys/conf/files:153",
    "sys/dev/netif/ath/ath_hal/Makefile:14"
  ],
  "poc_changes": "No PoC built: the cited path is not compiled into the shipped ath_hal.ko or kernel (proven read-only on the guest). A reachability probe script (reachability.sh) replaces the trigger.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root ...reachability probes... (see reachability.sh; read-only)",
  "code_hash": "6d7cd6789ffa3ea3b4f64b33dd2de19cb4a4e3922cadf85ea6cf78f36ea29c9d",
  "notes": "Reserved IDs DF-5030..DF-5041; this pack uses DF-5030. Other latent nits in the file (dup VENICE condition 157-160, dead stores 149-150, (uint32_t)sh truncation 139-152) recorded in VERDICT.md, not filed. Error-unwind path audited and found sound (ar5212RfDetach NULL-guard ar5212.h:403-406).",
  "recommended_fix": "Validate the BSP-supplied ar531x_config in ar5312GetMacAddr: reject NULL config/board and board->magic != AR531X_BD_MAGIC before the 6-byte copy (fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation not applicable: Info-severity latent finding, no runtime baseline exists on the guest (file not compiled), Phase V skipped per contract.",
  "fix_evidence": "n/a (no fix build performed)"
}