⬢ DragonFlyBSD Kernel Audit
DF-5068 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5068",
  "status": "untested",
  "verdict": "psm_init_power_state_table() assigns result = hwmgr->hwmgr_func->get_pp_table_entry(hwmgr, i, state) at sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:76 and never checks or returns it: a VBIOS PowerPlay entry whose parser fails midway (trivial to craft given the pass-1 unvalidated-offset family DF-1468/1469/1470) leaves a partially-written or all-zero pp_power_state permanently in the table, and init still returns 0. A half state whose classification flags were written before the failure becomes boot_ps and is memcpyd into current_ps/request_ps (pp_psm.c:78-82) or matches ui_label in psm_get_ui_state (:122-128) and is selected by psm_set_states (:163-169), after which power_state_management() (:248-255) programs the garbage hardware struct to the SMC. If all entries fail, boot_ps stays NULL and current/request stay zeroed while ps is non-NULL, feeding all-zero clock/voltage states to every later adjust cycle. Requires an AMD GPU with crafted VBIOS - the audit guest has none (QEMU std VGA chip=0x11111234, /dev/dri absent, no amdgpu attach; env.txt), so no runtime trigger or fix boot-validation is possible.",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-annotated defect + consequence chain through :78-82/:122-128/:163-169/:248-255); env.txt (hardware-absence documentation); fix.diff (fail init and unwind on parser error).",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:75",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:76",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:78",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:87",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:91",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:122",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:163",
    "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:248",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:238"
  ],
  "poc_changes": "No PoC exists (trigger requires an AMD GPU with crafted VBIOS PowerPlay table). Evidence pack is analysis-only with hardware-absence documentation.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "b5d9a48c740189e0c51083bb8037c7408ccf136d4f4d9f861f8d0e591838dcce",
  "notes": "code_hash is sha256 of fix.diff (no runnable PoC - hardware-gated). Defect existence is certain (unused result variable); confidence likely reflects the parser-write-ordering dependency of the worst-case consequence chain. Threat model identical to the pass-1 VBIOS family (crafted GPU / re-flashed VBIOS / malicious PCIe device). Guest left clean and up.",
  "recommended_fix": "Check get_pp_table_entry()s return in psm_init_power_state_table() and fail init (unwinding the three allocations) on any nonzero entry result (pp_psm.c:76).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff makes init fail-fast and unwind on the first parser error; hwmgr_hw_init() already routes a nonzero psm_init return into its err2 unwind (hwmgr.c:238-240). Cannot be boot-validated on the audit guest - the path requires an AMD GPU with an attachable-but-malicious VBIOS (env.txt).",
  "fix_evidence": "findings/poc/DF-5068/fix.diff; VERDICT.md fix section."
}