⬢ DragonFlyBSD Kernel Audit
DF-5088 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-5088",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Pass-2 deep-dive of i2c_generic_hw_engine.c found three latent boundary defects in the generic HW-I2C chunker \u2014 (1) max_payload_size==1 degenerates into a zero-payload address-only first transaction followed by unaddressed 1-byte start_bit=0 transactions (i2c_generic_hw_engine.c:150-158, sibling of the known DF-2090 max==0 underflow), (2) zero-length payloads fall through to FAILED_INCOMPLETE because operation_result keeps its I2C_CHANNEL_OPERATION_FAILED initializer when the while-loop never runs (:103-104, :138, :240-243) while the live base path handles them fine (i2c_hw_engine.c:91-123), and (3) get_transaction_timeout omits the in-batch clock-stretch term (buffer_used_bytes<<3 + transaction_count<<1) that both real engines add (this file :269-270 vs i2c_hw_engine_dce80.c:757-761 and i2c_hw_engine_dce110.c:462-465), giving mid-batch chunks too-short timeouts. Pass 2 also PROVED the entire unit is dead in this port, not just the DF-2090 expression: zero callers of dal_i2c_generic_hw_engine_* outside the unit, no instantiation of struct i2c_generic_hw_engine_funcs, i2caux->i2c_generic_hw_engine permanently NULL (i2caux.c:447), and both real engines wire dal_i2c_hw_engine_submit_request instead (i2c_hw_engine_dce80.c:815, i2c_hw_engine_dce110.c:498) \u2014 while the file is still compiled into the dc module (amd/amdgpu/Makefile). No input, privileged or not, can reach any line of it, so impact today is none and runtime PoC verification is impossible by construction (plus the guest has no AMD display HW \u2014 env.txt). Recorded untested per the persist enum; all claims are line-level source facts in VERDICT.md.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5088/VERDICT.md (deadness proof + three defect traces with path:line); README.md; fix.diff (self-contained max_payload_size<2 guard, closes both the DF-2090 underflow and the ==1 degenerate case at the single boundary); env.txt + run.log (guest hardware gate)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:96",
    "sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:150",
    "sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:158",
    "sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:138",
    "sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:240",
    "sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c:269",
    "sys/dev/drm/amd/display/dc/i2caux/i2c_hw_engine_dce80.c:736",
    "sys/dev/drm/amd/display/dc/i2caux/dce80/i2c_hw_engine_dce80.c:757",
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2c_hw_engine_dce110.c:462",
    "sys/dev/drm/amd/display/dc/i2caux/dce80/i2c_hw_engine_dce80.c:815",
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2c_hw_engine_dce110.c:498",
    "sys/dev/drm/amd/display/dc/i2caux/i2caux.c:447",
    "sys/dev/drm/amd/display/dc/i2caux/i2caux_dce80.c:132"
  ],
  "poc_changes": "n/a \u2014 no PoC seed; unit unreachable by construction (dead code) and guest lacks AMD display hardware",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root uname -a; pciconf -l | grep -i vga; kldstat | grep -ci \"radeon\\|drm\"; ls /dev/dri (env probe \u2014 run.log/env.txt)",
  "code_hash": "",
  "notes": "Info/latent: per contract PoC skippable for Info; recorded untested (persist enum has no not_testable/skipped). Dead-code proof is the pass-2 delta over DF-2090. DF-2090 itself (max==0 underflow) NOT re-reported. Also killed this pass: no infinite loop for max>=2 (:220-221 always advances); no transaction-array indexing in this file (that lives in dce80/dce110 with the count==3 clamp); no kernel-memory OOB from chunk math (payload length == caller buffer size, engine.h:41-46 \u2014 DF-2090s overflow victim is the 144-byte DC_I2C MMIO FIFO, not kernel memory); timeout math cannot overflow u32 for len<=145. DF-5087-style used/available races cannot interact with this file because it is never entered.",
  "recommended_fix": "Hardened boundary guard: reject max_payload_size < 2 with FAILED_BUFFER_OVERFLOW (fix.diff; also closes DF-2090), add the in-batch stretch term to the timeout when the unit is ever wired, or delete the dead unit outright",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate reading (self-contained guard); kernel fix-build validation meaningless \u2014 the guarded path is unreachable on every build of this tree and the guest has no AMD display hardware",
  "fix_evidence": "findings/poc/DF-5088/fix.diff"
}