{
  "finding_id": "DF-5155",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "likely",
  "verdict": "reproduced (consequence-level): perfbias is compiled into stock X86_64_GENERIC (device perfbias, config:173) and its cpuhelper-dispatched handler executes the raw pair wrmsr(0x1b0)/rdmsr(0x1b0) (perfbias.c:178-179) gated only by the live CPUID.06H.ECX bit 3 check in perfbias_identify (:99-103) - no model blacklist, no fault-safe accessor. Guest proof chain on the KVM/Skylake host: (1) stock qemu64 - leaf 6 = 0, gated; (2) QEMU_EXTRA=-cpu host - KVM still masks the SETBH bit (vendor Intel, cpu_high>=6, yet no machdep.perfbias0.hint, dmesg count 0) exactly because it does not virtualize MSR 0x1b0; (3) trigger module (pbtest.ko, -Werror) executing the exact perfbias.c:178-179 instructions in kernel context: rdmsr_safe(0x1b0) -> error 14, wrmsr_safe -> error 14, then raw wrmsr -> Fatal trap 9: general protection fault while in kernel mode ... Stopped at pbtest_modevent+0xad: wrmsr, guest dead in DDB (panic.txt/run.log). On any VMM/CPU that DOES advertise ECX bit 3 without implementing the MSR (the DF-4735 lying-CPUID class, demonstrated for leaf-6 MSRs on this very VMM), the stock compiled-in driver therefore panics on the first root sysctl write to machdep.perfbiasN.hint (write needs SYSCAP_NOSYSCTL_WR, kern_sysctl.c:1446) or on driver detach (:152). Root-gated: Low severity, privileged local DoS; no privilege boundary crossed. Fix build-validated (nativekernel RC=0, perfbias.c -Werror at fix_build.log:17769), patched kernel installed and booted clean, and the post-fix handler shape (pbfix.ko) demonstrably returns error 14 to the sysctl writer on the same faulting platform instead of trapping.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5155/panic.txt (fatal trap 9 + Stopped at ... wrmsr console capture); run.log (full serial log incl. the two error-14 lines proving the graceful branch); run.2.log (patched kernel #1 boot + pbfix.ko no-trap run); pbtest.c/pbfix.c + build.sh + run.sh; env.txt (leaf-6 gating on both cpu models); fix.diff (validated to apply exactly); fix_build.log (RC=0)",
  "kernel_refs": [
    "sys/dev/powermng/perfbias/perfbias.c:178",
    "sys/dev/powermng/perfbias/perfbias.c:179",
    "sys/dev/powermng/perfbias/perfbias.c:99",
    "sys/dev/powermng/perfbias/perfbias.c:103",
    "sys/dev/powermng/perfbias/perfbias.c:152",
    "sys/dev/powermng/perfbias/perfbias.c:166",
    "sys/kern/kern_sysctl.c:1446",
    "sys/config/X86_64_GENERIC:173"
  ],
  "poc_changes": "trigger authored fresh (no seed): minimal kld built with bsd.kmod.mk -Werror on the -cpu host guest; pbfix.c replicates the patched handler verbatim for the post-fix demonstration",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline); patched #1 kernel for fix validation",
  "runtime_sec": 2760,
  "guest_dirty": 1,
  "build_cmd": "cd /tmp/pbmod && printf KMOD=\\tpbtest\\nSRCS=\\tpbtest.c\\n\\n.include <bsd.kmod.mk>\\n > Makefile && make SYSDIR=/usr/src/sys",
  "run_cmd": "kldload /tmp/pbmod/pbtest.ko   # -> rdmsr_safe/wrmsr_safe error 14, then Fatal trap 9 GPF at raw wrmsr, DDB, guest down",
  "code_hash": "e8607f3d418c2405717dac5ec68a5acbaa3eb2c5e312915c6d0469540b1da6f6",
  "notes": "in-driver execution not observable on this guest because KVM masks CPUID.06H.ECX bit 3 (proven by attach failure under -cpu host with vendor Intel + leaf 6 present); the trigger reproduces the exact instruction pair/MSR/kernel-mode context and its fatal trap on a platform whose own masking policy demonstrates the lying-CPUID class is real and anticipated by VMM vendors. Context note: kld thread vs cpuhelper thread - both ordinary kernel threads, identical #GP/trap outcome. The same run demonstrates the fix semantics: wrmsr_safe/rdmsr_safe on the identical MSR return error 14 without trapping. Sysctl range check (0..15) verified correct; ch_cbarg1 int->uint64_t widening safe post-clamp; detach ordering correct; full negative notes in VERDICT.md.",
  "recommended_fix": "perfbias_set_handler: use wrmsr_safe/rdmsr_safe; propagate the error via cpuhelper_replymsg -> perfbias_set -> sysctl (writer gets EIO); update sc_hint only on success.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "baseline reproduced (raw wrmsr(0x1b0) -> Fatal trap 9 on the stock compiled-in-driver kernel, guest dead in DDB); fix applied to guest /usr/src, single-fix kernel built with make -j6 nativekernel KERNCONF=X86_64_GENERIC (RC=0, perfbias.c under -Werror, fix_build.log:17769), installed, and booted clean; pbfix.ko (the patched handler body, verbatim shape) loaded on the patched kernel on the same faulting platform returns error 14 to the caller with no trap and the guest stays up. In-delta perfbias runtime comparison not observable on this guest (KVM masks the SETBH bit so perfbias never attaches).",
  "fix_evidence": "findings/poc/DF-5155/fix_build.log (RC=0; :17769 perfbias.c -Werror; :26109 perfbias.o); fix.diff (applies exactly); run.2.log (patched #1 kernel boot + pbfix returns error 14 ... no trap, guest up); baseline: panic.txt"
}