⬢ DragonFlyBSD Kernel Audit
DF-5067 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5067",
  "status": "untested",
  "verdict": "Latent NULL-deref hazard, not a live bug: power_state_management() (sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:234-257) passes hwmgr->current_ps into phm_apply_state_adjust_rules() at :248 before any NULL check (smu8 backend dereferences it unconditionally at smu8_hwmgr.c:1044-1045,1066), and explicitly acknowledges pcurrent==NULL at :249 only to route control into :254 phm_set_power_state(hwmgr, &pcurrent->hardware, ...) on the NULL pointer. Today the dead NULL branch is unreachable because psm_init_power_state_table() allocates ps/request_ps/current_ps all-or-nothing (pp_psm.c:53-71) and psm_fini NULLs them together (pp_psm.c:102-107); the sole guard is the implicit invariant behind the hwmgr->ps check at :270. Filed as the DF-1913/DF-4831/DF-4886 latent family. Not runnable on the audit guest: requires an AMD GPU; the QEMU guest has only std VGA (chip=0x11111234), /dev/dri absent, no amdgpu attach (env.txt).",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "VERDICT.md (annotated source walk pp_psm.c:246-254 + smu8_hwmgr.c:1044-1066 deref proof + invariant analysis why it is latent); env.txt (guest pciconf/dmesg//dev/dri evidence that the path is hardware-gated); fix.diff (early-return guard).",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:234",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:248",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:249",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:254",
    "sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:125",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1044",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1066",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:53",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:102"
  ],
  "poc_changes": "No PoC exists (finding is a latent static hazard). Evidence pack is analysis-only with hardware-absence documentation.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "bf0f2fbe8a275d54adb9b71e13d8fe43f02490cf1573c2e33f9f5abc09c66a22",
  "notes": "code_hash is sha256 of fix.diff (no PoC source authored - hardware-gated latent finding, guest lacks any AMD GPU). Static ceiling if the invariant ever breaks: kernel NULL-deref panic on CZ/Stoney via smu8 apply_state_adjust_rules, or on any ASIC via :254. Attempts=1 = the hardware-presence check on the guest. Guest left clean and up.",
  "recommended_fix": "Early-return from power_state_management() when hwmgr->current_ps is NULL (pp_psm.c:247) so neither the :248 backend pass-through nor the :254 &pcurrent->hardware dereference can run on NULL.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the early-return guard; cannot be boot-validated on the audit guest because the vulnerable path requires an AMD GPU (no amdgpu attach possible on QEMU std VGA - see env.txt). Fix is a two-line invariant-preserving guard reviewed against all power_state_management() callers.",
  "fix_evidence": "findings/poc/DF-5067/fix.diff; VERDICT.md fix section."
}