⬢ DragonFlyBSD Kernel Audit
DF-5080 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5080",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static-inspection finding, certain by code trace but untestable on this guest: nsgphy_status() (sys/dev/netif/mii_layer/nsgphy.c:252-256) decodes IFM_1000_T directly from the 1000STS link-partner capability bits (LPFD/LPHD, nsgphyreg.h:137-138) without checking the master/slave resolution bit MSR (nsgphyreg.h:134) or the master/slave fault bit MSF (nsgphyreg.h:133), and never reports IFM_ETH_MASTER. On an MS-faulted or not-yet-resolved 1000BASE-T autoneg the kernel therefore reports a phantom 1000baseT media/baudrate to ifconfig, link-state consumers and NIC statchg callbacks (mii_physubr.c:451-505), while e1000phy gates the same decode on a resolution bit (e1000phy.c:478-483). Security impact is limited to operator-visible correctness (no memory safety, no privilege boundary) \u2014 severity Low. The guest has no NatSemi DP83891/DP83861 PHY (virtio-net only; see env.txt), so the driver cannot attach and no runtime PoC is possible; per contract (Low, non-corruption) verification is skipped with that justification recorded here.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5080/VERDICT.md (static proof chain, impact ceiling), README.md (root cause with path:line), env.txt (guest hardware inventory proving the driver cannot attach: pciconf shows only Intel PIIX atapci + virtio-net), fix.diff (MSF/MSR/IFM_ETH_MASTER gating). Decisive lines: nsgphy.c:252-256 decode, nsgphyreg.h:133-138 bit definitions, e1000phy.c:478-483 correct-family shape, mii_physubr.c:465,486-505 consumers.",
  "kernel_refs": [
    "sys/dev/netif/mii_layer/nsgphy.c:252",
    "sys/dev/netif/mii_layer/nsgphy.c:253",
    "sys/dev/netif/mii_layer/nsgphy.c:256",
    "sys/dev/netif/mii_layer/nsgphyreg.h:133",
    "sys/dev/netif/mii_layer/nsgphyreg.h:134",
    "sys/dev/netif/mii_layer/e1000phy.c:478",
    "sys/dev/netif/mii_layer/mii_physubr.c:465"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC; finding produced by this runs audit. Hardware-gated (DP83891/DP83861 PHY absent from guest), so no trigger program was authored; the evidence is a line-cited static trace instead.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 mii family checklist applied in full to nsgphy.c: (a) empty-media family (DF-4930/DF-5001) does NOT reach this file \u2014 nsgphy.c:144 unconditionally ADDs an IFM_NONE entry before the no media present branch at 158-162, so miibus_mediainit (mii.c:238-244) always finds a match; atphy.c:140-144 lacks that early ADD, which is exactly why the family panic fires there. (b) service KKASSERT family (DF-1973/DF-5009): nsgphy_service has no asserts and uses the standard guarded ife deref; ifm_cur is set before attach returns via nsgphy.c:167 -> miibus_mediainit -> ifmedia_set. (c) status decode \u2014 THIS finding. (d) reset waits: generic mii_phy_reset (mii_physubr.c:183-213, 500us + 100ms poll), no local override. (e) probe sentinel: MII_PHYDESC_NULL at nsgphy.c:84, mii_phy_match stops on mpd_name==NULL (mii_physubr.c:557). (f) no DSP/RAM vendor-reg access in this driver; all regs used (0x00-0x11) within MII space. Uninit-read candidate at nsgphy.c:159 killed: newbus softc is kmallocd M_ZERO (subr_bus.c:1953-1955).",
  "recommended_fix": "In nsgphy_status(), treat NSGPHY_1000STS_MSF as no 1000 link (report IFM_NONE), and only decode IFM_1000_T from LPFD/LPHD after checking NSGPHY_1000STS_MSR, additionally reporting IFM_ETH_MASTER when MSR is set \u2014 see fix.diff.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation cycle not applicable: no runtime reproduction is possible on this guest (driver requires a physical DP83891/DP83861 PHY; guest NIC is virtio \u2014 env.txt), and this is a Low correctness finding, not memory corruption. fix.diff was authored against the read-only sys/ tree only.",
  "fix_evidence": "findings/poc/DF-5080/fix.diff (gates 1000T decode on MSF-clear, adds MSR/IFM_ETH_MASTER reporting); not applied or built per audit rules."
}