⬢ DragonFlyBSD Kernel Audit
DF-5084 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5084",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level units bug is CERTAIN (ai_aperture_size is BYTES tree-wide per agpvar.h:50 + agp.c:904 + drm_agpsupport.c:500, but radeon_agp.c:152 compares it to 32-as-MB and :245 shifts it <<20 as if MB), yet the entire buggy body is NOT COMPILED on DragonFly: proven on the guest with the radeon modules exact build flags (cc -include /usr/src/sys/dev/drm/kconfig.h -> IS_ENABLED(CONFIG_AGP)==0, controls PCI/CIK=1, UNDEF=0), guest /usr/src md5-identical to the audited tree. radeon_agp_init therefore compiles to { return 0; }. No runtime manifestation exists in any shipped build; the PoC demonstrates the latency (AGP_DISABLED) and, arithmetically, the 2^20x-inflated gtt_size + inverted AIC_HI_ADDR window that would result if CONFIG_AGP is ever defined. Kernel-visible impact ceiling if enabled: dead minimum-aperture guard, 64MB->64TB TTM GTT heap (radeon_ttm.c:940-941), truncated/inverted GPU DMA-window registers (r100.c:662-663, r100.c:3864-3865, r300.c:1334-1335, r520.c:153-154, evergreen.c:2892-2894) -> functional DoS on AGP radeon hardware; GATT OOB binds remain blocked by agp.c:520-522, so no direct kernel memory corruption. Filed as Info/latent.",
  "exploit_chain": "",
  "evidence": "run.log: agp = AGP_DISABLED with controls pci/cik=ENABLED, undef=DISABLED (decisive: code not compiled); run.log units_demo table: 64MB@0xd0000000 -> gtt_size=0x400000000000 (64TB), AIC_HI_ADDR=0xcfffffff < AIC_LO=0xd0000000 (inverted DMA window); env.txt: guest md5 of radeon_agp.c/kconfig.h matches audit tree; VERDICT.md sections 2-4.",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_agp.c:152",
    "sys/dev/drm/radeon/radeon_agp.c:245",
    "sys/dev/agp/agp.c:904",
    "sys/dev/agp/agpvar.h:50",
    "sys/dev/drm/drm_agpsupport.c:500",
    "sys/dev/drm/kconfig.h",
    "sys/dev/drm/radeon/Makefile:148",
    "sys/dev/drm/radeon/radeon_ttm.c:940",
    "sys/dev/drm/radeon/r100.c:662"
  ],
  "poc_changes": "No seed PoC existed (finding discovered this pass). Built two artifacts: iscfg2.c (preprocessor reachability proof with positive/negative controls) and units_demo.c (exact radeon_agp.c:245-247 arithmetic + truncated 32-bit register values), both run on the QEMU guest with the radeon modules own -include/-I flags.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root cc -include /usr/src/sys/dev/drm/kconfig.h -I/usr/src/sys/dev/drm/include -E /tmp/iscfg2.c ; cc -O2 -o /tmp/units_demo /tmp/units_demo.c",
  "run_cmd": "sh run.sh  (iscfg2 preprocess + /tmp/units_demo + pciconf/kldstat hardware inventory)",
  "code_hash": "7926635f456009cfa09315731006b6bf3fc6a4f3e237df971c39229072d847d4 (iscfg2.c); 708290547196410dcb6245d857be34b05ddd71759b53b27aeb183ed7b4418998 (units_demo.c)",
  "notes": "Guest has no AGP bridge / no ATI hardware (7 PCI devs, QEMU std VGA) and no drm modules loaded - hardware manifestation impossible here even if the code were compiled. Shipped-code corollary (not filed separately): the #else stub returns 0=success, so on real AGP hw the driver keeps RADEON_IS_AGP with mc.gtt_size==0 -> empty TT heap -> fail-closed (no GTT objects), and the !ddev->agp guard at radeon_ttm.c:147-160 is itself inside #if IS_ENABLED(CONFIG_AGP) i.e. also compiled out. All other radeon_agp.c classes killed: acquire/release balanced, quirk list NUL-terminated, agpmode pow2-validated boot param, no NULL-deref (drm_agp_acquire EINVAL-guards !dev->agp).",
  "recommended_fix": "Treat ai_aperture_size as bytes: compare against (32U<<20) at :152 (print >>20) and drop the <<20 at :245 - see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "not_testable: the patched lines live inside #if IS_ENABLED(CONFIG_AGP) which is 0 on DragonFly (proven this run), so baseline and patched builds compile to identical stubs - no observable behavior difference can be demonstrated on any DF build or on this guest (no AGP/radeon hardware). The fix is a 3-line units correction matching modern Linux (aper_size in bytes, no shift) and DFs own byte-unit AGP layer (drm_agpsupport.c:500).",
  "fix_evidence": "fix.diff authored against read-only sys/ tree, never applied; reachability proof run.log:2 (AGP_DISABLED) explains why fix validation is not possible."
}