⬢ DragonFlyBSD Kernel Audit
DF-5048 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5048",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "DF-5026-family parked-bios hang: once an IDA controller stops delivering completions there is no code path anywhere in the driver that fails a queued bio \u2014 idad_strategy submits unconditionally (ida_disk.c:172-177), ida_construct_qcb silently parks bios when the 256-QCB pool is exhausted (ida.c:385-387), the only reaper is ida_done via ida_intr (ida.c:498-537,470-493), and no watchdog/timeout/offline-flag exists (ida.c/ida_disk.c contain no callout; idavar.h:122-124 flags are ATTACHED/FIRMWARE/INTERRUPTS only). Result: every issuer sleeps unkillably in biowait (D-state), mounted filesystems hang, and bio_queue grows unbounded. Untested solely because the guest has no IDA hardware. Rated Low rather than DF-5026s Medium because IDA has no software offline knob \u2014 a genuine hardware wedge is required.",
  "exploit_chain": "",
  "evidence": "env.txt (no 0x0e11 PCI function, no /dev/idad*); VERDICT.md completion-flow enumeration showing biodone is unreachable for parked bios; fix.diff (git apply --check clean)",
  "kernel_refs": [
    "sys/dev/raid/ida/ida_disk.c:144-189",
    "sys/dev/raid/ida/ida.c:364-370",
    "sys/dev/raid/ida/ida.c:372-417",
    "sys/dev/raid/ida/ida.c:424-440",
    "sys/dev/raid/ida/ida.c:470-493",
    "sys/dev/raid/ida/ida.c:498-537",
    "sys/dev/raid/ida/idavar.h:93",
    "sys/dev/raid/ida/idavar.h:122-124"
  ],
  "poc_changes": "No runnable PoC exists (hardware-gated: requires a physically wedged SMART/IDA controller). Pack carries the code trace + hardware-absence evidence; fix.diff validated with git apply --check.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "n/a \u2014 hardware-gated, no PoC build possible",
  "run_cmd": "vm.sh run_root pciconf -l | grep -i 0e11; ls /dev/idad* (result: absent/empty)",
  "code_hash": "02505976d41b5c2885cee8fe164bc256dfa079e4c8a84b14cbd394e0548b6f1a (sha256 of fix.diff; no PoC source exists)",
  "notes": "Distinct from ida.c pass-1 findings DF-1915 (detach-time free), DF-1916 (SMP queue race), DF-4837 (DMA-direction corruption): this is the absent-failure-path hang. DF-5012-style strategy error paths are NOT present here \u2014 ida_disk.c already biodones every local error (ida_disk.c:153-188).",
  "recommended_fix": "Add a watchdog callout (1 Hz): after 60 consecutive ticks with pending work and no drain, fail all queued bios with ETIMEDOUT and keep failing new arrivals so issuers stay killable.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (ida.c + idavar.h) adds the stall-counter watchdog: callout started in ida_init, callout_stop_sync in ida_free, fail-queued-bios logic in ida_watchdog. Closes the unbounded-park behavior; accepted tradeoff: a live-but-60s-backlogged controller would start erroring I/O. Cannot be build/boot validated without IDA hardware.",
  "fix_evidence": "fix.diff (git apply --check: APPLIES_CLEAN); hunks at ida.c includes/prototypes/ida_free/ida_init/new ida_watchdog, idavar.h struct ida_softc"
}