⬢ DragonFlyBSD Kernel Audit
DF-5031 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-5031",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "it_generic_stemp (sys/dev/powermng/it/it.c:259-261) reads IT87xx temperature registers via it_readreg() which returns u_int8_t (it.c:192-197) and never applies the required (int8_t) signed conversion, so sub-zero temperatures (0x80..0xFF = -128..-1 degC) are published under hw.sensors as +128..+255 degC; the in-tree comment also mislabels the framework unit (\u00b5K) as Fahrenheit. Pure sensor-data correctness defect inherited from the OpenBSD ancestor; no memory-safety impact (value is int64_t, arithmetic bounded at ~5.3e8). Driver absent on the audit guest (no device it in X86_64_GENERIC, no it.ko shipped/loaded, no IT87xx silicon in QEMU) and gated behind admin-only config, so Phase V runtime PoC skipped per contract.",
  "exploit_chain": "",
  "evidence": "reachability.log (guest: device-it-in-config 0, it.ko NONE, it-loaded 0); it.c:259-261, it.c:192-197, itvar.h:62, sys/sys/sensors.h:146, sys/conf/files:2601; VERDICT.md (full negative-result list)",
  "kernel_refs": [
    "sys/dev/powermng/it/it.c:259",
    "sys/dev/powermng/it/it.c:261",
    "sys/dev/powermng/it/it.c:192",
    "sys/dev/powermng/it/itvar.h:62",
    "sys/sys/sensors.h:146",
    "sys/conf/files:2601"
  ],
  "poc_changes": "No PoC built: driver not compiled into the default kernel (optional it isa) and no IT87xx hardware exists behind QEMU. reachability.sh replaces the trigger.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root ...reachability probes... (see reachability.sh; read-only)",
  "code_hash": "a25bd36bfd32ee58949bfe305276273f4b38abcc6710e6e188c71f342c03bc4a",
  "notes": "Reserved IDs DF-5030..DF-5041; this pack uses DF-5031. Pass-2 negative results with citations in VERDICT.md: fan div0 impossible, volt math int64-safe, sensor array bounds exact, chip-ID exact-match, detach/sensor-task lifetime safe via kern_sensors.c lock protocol, softc M_ZERO kills uninit-value leak, port I/O confined to offsets 5-6 of 8.",
  "recommended_fix": "Cast the temperature register read to signed in it_generic_stemp: sdata = (int8_t)it_readreg(sc, ITD_SENSORTEMPBASE + i); and fix the unit comment (fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation not applicable: Info-severity correctness finding, no runtime baseline exists on the guest (driver not compiled, hardware absent), Phase V skipped per contract.",
  "fix_evidence": "n/a (no fix build performed)"
}