⬢ DragonFlyBSD Kernel Audit
DF-5092 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5092",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static proof certain: ar5416GpioCfgInput (ar5416_gpio.c:150-151) clears the 2-bit drive field of AR_GPIO_OE_OUT and then immediately sets AR_GPIO_OE_OUT_DRV_ALL (0x3 = drive always), the opposite of the tristate its own line-146 comment promises and the opposite of the ar5210/5211/5212 twins (ar5212_gpio.c:57-66 and ar5211_misc.c:213-225 tristate via CR_N). Consequence: consumers that configure externally-driven sense pins (ar5416_btcoex.c:355-356, 388 BT active/priority inputs; ar5416_btcoex.c:237 WLAN-active released on disable) actively drive those pins \u2014 electrical contention with the BT module and broken btcoex sampling. No kernel-memory impact; reachable only after ath_hal attach on real AR5416-family silicon, driven by root-gated config (EEPROM pin selects, hw.ath.N sysctls). Runtime verification impossible on the audit guest: QEMU emulates no Atheros NIC (zero ath(4) probes in dfbsd-qemu/boot.log); ath_hal is compiled into GENERIC (X86_64_GENERIC:263-266) but the path never executes without hardware, so the finding is honestly recorded as untested rather than not_reproduced. Byte-identical to FreeBSD CURRENT (checked 2026-09-27): upstream-inherited; fix should go upstream.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5092/verify_static.out \u2014 decisive lines: ar5416_gpio.c:146 comment (set output to tristate) vs :151 reg |= AR_GPIO_OE_OUT_DRV_ALL << gpio_shift; vs ar5412_gpio.c:62-63 tristate twin and ar5416_btcoex.c:355-356 consumers; ar5416reg.h:571/574 value meanings",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:146",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:150",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_gpio.c:151",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416reg.h:571",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416reg.h:574",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:61",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_btcoex.c:355",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_btcoex.c:388",
    "sys/config/X86_64_GENERIC:263"
  ],
  "poc_changes": "No seeded PoC existed; authored verify_static.sh (host-side static trace) because the code path is hardware-only (device MMIO at AR_GPIO_OE_OUT 0x404c, requires an attached Atheros NIC).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Sep 22 00:51:18 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (from dfbsd-qemu/env.txt; guest not booted this run \u2014 no software repro path exists)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-5092/verify_static.sh",
  "run_cmd": "N/A \u2014 requires AR5416-family hardware absent from the QEMU guest (no ath(4) device in dfbsd-qemu/boot.log)",
  "code_hash": "255130cd7e3eec0f4054e478bdfd06e9d2c226f2cf79ec4b742dbcba7c41b124",
  "notes": "Pass 2 of ar5416_gpio.c. Known DF-2098 (unvalidated index, HALASSERT no-op per ah_internal.h:665-676) and DF-2099 (KIWI missing-else) NOT re-reported; DF-2098 consumer chain re-verified as root-gated via if_ath_sysctl.c:210-221 hw.ath.N.ledpin -> if_ath_led.c:128. ar5416GpioSetIntr (ar5416_gpio.c:207-278) is dead code in this tree (sole reference is the ath_hal_gpioSetIntr macro, ah_internal.h:452; no driver callers). File is byte-identical to FreeBSD CURRENT \u2014 zero DF-local divergence.",
  "recommended_fix": "Delete the reg |= AR_GPIO_OE_OUT_DRV_ALL << gpio_shift; line in ar5416GpioCfgInput so the cleared field stays AR_GPIO_OE_OUT_DRV_NO (tristate), matching the ar5210/5211/5212 twins; upstream the same fix to FreeBSD.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (one-line deletion, verified to apply cleanly against the read-only sys/ tree) restores tristate semantics, but kernel-level fix validation requires the same AR5416-family hardware absent from the audit guest, hence not_testable. Fix validated by inspection only: after the deletion the 2-bit field remains 0x00 = AR_GPIO_OE_OUT_DRV_NO, exactly the ar5212/ar5211 behavior.",
  "fix_evidence": "findings/poc/DF-5092/fix.diff (applies to ar5416_gpio.c:146-152); semantics cross-checked against ar5212_gpio.c:61-63 and ar5416reg.h:571-574"
}