⬢ DragonFlyBSD Kernel Audit
DF-5053 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-5053",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED with the REAL qsphy driver in the backtrace: a synthetic single-PHY MII controller KLD (qsmedia.ko) presents a QS6612 (PHYIDR1=0x0181/PHYIDR2=0x4401 -> OUI 0x6051/model 0) whose BMSR loses its media capability bits across the BMCR_RESET that qsphy_attach itself issues (qsphy.c:162 -> :166); the attach takes the no media present branch (qsphy.c:168-171), skips mii_phy_add_media, and MIIBUS_MEDIAINIT (qsphy.c:174) -> miibus_mediainit walks an EMPTY ifm_list and terminates in ifmedia_set(&mii->mii_media,0) (mii.c:244) -> panic(\"ifmedia_set\") \u2014 serial console: qsphy0:  no media present / ifmedia_set: no match for 0x0/0xfffffff / panic: ifmedia_set, backtrace ifmedia_set <- qsphy_attach <- device_doattach <- bus_generic_attach <- miibus_attach; ssh died, guest down. 5th leaf of the atphy DF-4930 / ciphy DF-4957 / jmphy DF-4981 / truephy DF-5003 family (hub: DF-5001). FIX VALIDATED BEHAVIORALLY: fix.diff (ifmedia_add IFM_NONE fallback in the no-media branch, mirroring DF-5003s leaf fix; mii_phy_add_medias own fallback is unavailable because qsphy always sets MIIF_NOISOLATE, qsphy.c:160 vs mii_physubr.c:230) applied to guest /usr/src, nativekernel -Werror rebuild RC=0 (qsphy.o compiled at kbuild.log:18760), installkernel, reboot into kernel #1, and the EXACT same kldload trigger now completes with NO panic and clean kldunload; mechanism replay on stock guest (run.2.log) additionally shows ifm_cur non-NULL post-fix (the invariant keeping *_service() entry derefs safe). Sources reverted md5-verified pristine; guest reset to the with-src snapshot. Attach/boot-time DoS only: requires a PHY that matches the QS6612 ID probe yet reports zero media capabilities after reset \u2014 no unprivileged userland path, no memory corruption (deliberate panic sink).",
  "exploit_chain": "",
  "evidence": "panic.txt + run.log (decisive: qsphy0:  no media present -> panic: ifmedia_set with qsphy_attach+0x159 in the trace); run.3.log (patched kernel: same kldload survives, KLDLOAD_RC=0, clean detach); run.2.log (fixcheck mechanism, ifm_cur=... media=0x22); kernel_build.log (nativekernel -Werror, qsphy.o compile line); build.log; qsmedia.c; VERDICT.md",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/qsphy.c:160",
    "sys/dev/netif/mii_layer/qsphy.c:162",
    "sys/dev/netif/mii_layer/qsphy.c:166",
    "sys/dev/netif/mii_layer/qsphy.c:168",
    "sys/dev/netif/mii_layer/qsphy.c:171",
    "sys/dev/netif/mii_layer/qsphy.c:174",
    "sys/dev/netif/mii_layer/mii.c:227",
    "sys/dev/netif/mii_layer/mii.c:244",
    "sys/dev/netif/mii_layer/mii.c:105",
    "sys/dev/netif/mii_layer/mii.h:109",
    "sys/dev/netif/mii_layer/miidevs:66",
    "sys/dev/netif/mii_layer/miidevs:241"
  ],
  "poc_changes": "Authored fresh (no seed). Adapted DF-5009s fakemic synthetic-MII-bus machinery to a single hosed QS6612: (1) the BMSR-media-lost latch keys on the drivers OWN BMCR_RESET write so the probe (miibus_no_phy, mii.c:113-115) still sees media bits; (2) QS6612 ID constants derived from miidevs OUI 0x006051/model 0 via mii.h:109-111 (PHYIDR1=0x0181, PHYIDR2=0x4401); (3) kenv hw.qsmedia.fixmode gate + hw.qsmedia_fixcheck sysctl (DF-5001s run_fix.sh pattern) so the fixed attach shape can replay on a live guest; (4) -Werror build fix (drop unused qsmedia_dev).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh   (make SYSDIR=/usr/src/sys -> qsmedia.ko)",
  "run_cmd": "sh run.sh     (kldload -> panic); sh run_fix.sh (fixcheck); fix.diff + make -j6 nativekernel KERNCONF=X86_64_GENERIC + installkernel + reboot + re-kldload (run.3.log)",
  "code_hash": "dccea0e99ad4fdcb6a0e0e34aef244dd68c2113aa7a7d7e878b7be721a7b4713",
  "notes": "Family: DF-4930 (atphy) / DF-4957 (ciphy) / DF-4981 (jmphy) / DF-5003 (truephy); hub fix territory = DF-5001 (mii.c) \u2014 the leaf fix here is defense-in-depth mirroring DF-5003s approved shape. Pass-2 negatives recorded in VERDICT.md: service entry uses the CORRECT guard form (no DF-1973/DF-5009 KKASSERT); the guards BMCR_ISO write ignoring MIIF_NOISOLATE is an inherited NetBSD functional nit (no memory safety); status decode default -> IFM_NONE is safe; reset waits bounded in mii_physubr.c:201-209; probe sentinel properly NULL-terminated; vendor regs (PCTL 0x1f / IMASK 0x1e / MCTL 0x11) are constant clause-22 indices (no PWRD register exists in qsphyreg.h).",
  "recommended_fix": "In the no-media branch, add ifmedia_add(&mii->mii_media, IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0, sc->mii_inst), MII_MEDIA_NONE, NULL); before MIIBUS_MEDIAINIT (per-leaf; the hub-level fix belongs to DF-5001).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fixed: fix.diff applied to guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC RC=0 (qsphy.c compiled -Werror, kernel_build.log); installkernel RC=0; reboot into kernel #1 (Sat Sep 26 16:13:05 UTC 2026); the identical kldload trigger completes WITHOUT panic (qsphy0:  no media present, miibus attaches, clean kldunload \u2014 run.3.log) vs stock-kernel panic (run.log/panic.txt). Sources reverted md5-verified (6c17ac33ff09cf4e26e4f5131b6adf7a); guest reset afterwards.",
  "fix_evidence": "fix.diff; kernel_build.log; run.log (baseline panic); run.2.log (mechanism fixcheck); run.3.log (patched-kernel behavioral run); VERDICT.md"
}