⬢ DragonFlyBSD Kernel Audit
DF-5118 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5118",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "State-machine defect is certain in code: dcons_crom_detach (dcons_crom.c:199-204) clears only dcons_conf->dma_tag, leaving dcons_conf->dma_map dangling (the map is destroyed two lines below) and the module-static dcons_paddr stale. Because dmamap_cb early-returns when dcons_paddr != 0 (dcons_crom.c:139-143), a re-attach of dcons_crom (device re-added without module unload) never re-wires dcons_conf->dma_tag/dma_map - the dcons core runs with dma_tag==NULL forever (bus_dmamap_sync silently skipped, dcons_os.c:176-206) while post_busreset keeps publishing the stale dcons_paddr into the ConfigROM (dcons_crom.c:120-121). Memory safety today is preserved solely by the dma_tag!=NULL guards in dcons_os.c:176-206 sitting in front of the unguarded dma_map use - a fragile invariant one refactor away from a UAF. Filed as Info hardening; untested because the guest has no FireWire controller (env.txt).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (state trace across detach/re-attach); env.txt (no FireWire hardware on guest)",
  "kernel_refs": [
    "sys/dev/misc/dcons/dcons_crom.c:199",
    "sys/dev/misc/dcons/dcons_crom.c:202",
    "sys/dev/misc/dcons/dcons_crom.c:203",
    "sys/dev/misc/dcons/dcons_crom.c:139",
    "sys/dev/misc/dcons/dcons_crom.c:144",
    "sys/dev/misc/dcons/dcons_os.c:176",
    "sys/dev/misc/dcons/dcons_os.c:200"
  ],
  "poc_changes": "n/a - no FireWire controller on the guest; trigger.sh documents the hardware-gated sequence",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "none",
  "run_cmd": "sh findings/poc/DF-5118/trigger.sh",
  "code_hash": "c2d1af96369dd63fe54c5f3363fc466fc9dec4cce3c858afd28aec827a91dd9f",
  "notes": "status untested per orchestrator enum. Fix is 2 added lines in detach (clear dma_map + dcons_paddr together with the tag).",
  "recommended_fix": "In dcons_crom_detach, clear dcons_conf->dma_map and reset dcons_paddr alongside dcons_conf->dma_tag so re-attach re-wires the globals instead of running on stale state.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored statically (2-line detach fix); cannot be validated on this guest - dcons_crom never instantiates without FireWire hardware.",
  "fix_evidence": "fix.diff; VERDICT.md"
}