⬢ DragonFlyBSD Kernel Audit
DF-5092 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5092",
  "title": "ar5416GpioCfgInput drives the GPIO pin (DRV_ALL) instead of tristating it, contradicting its own contract; BT-coexistence sense pins get actively driven",
  "file": "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "severity": "Info",
  "verdict_detail": "Static confirmation is certain (ar5416_gpio.c:150-151 sets AR_GPIO_OE_OUT_DRV_ALL despite the line-146 comment and despite the ar5210/5211/5212 twins tristating); runtime confirmation is impossible in the audit guest because the code path requires AR5416-family silicon the QEMU guest does not emulate (zero ath(4) probes in boot.log; ath_hal compiled into GENERIC at sys/config/X86_64_GENERIC:263-266 but never attached).",
  "exploit_chain": "",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:146",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:150",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:151",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416reg.h:570",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416reg.h:574",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:57",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:213",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_btcoex.c:355",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_btcoex.c:388"
  ],
  "reproduce": {
    "build": "sh findings/poc/DF-5092/verify_static.sh",
    "run": "N/A (needs AR5416-family NIC; see VERDICT.md)",
    "expected": "verify_static.out prints the DRV_ALL lines vs the tristating twins"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "verify_static.sh", "verify_static.out",
    "fix.diff", "manifest.json", "verdict.json"
  ],
  "upstream": "FreeBSD CURRENT sys/dev/ath/ath_hal/ar5416/ar5416_gpio.c is byte-identical (fetched 2026-09-27) — inherited bug; fix owner upstream"
}