⬢ DragonFlyBSD Kernel Audit
DF-5179 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5179",
  "status": "untested",
  "reproduced": false,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Source-confirmed boot-time kernel panic: atkbdattach() (atkbd_isa.c:119-122) forwards the unchecked result of bus_alloc_legacy_irq_resource() to BUS_SETUP_INTR(); when the allocation fails (missing hint.atkbd.N.irq defaults the ivar to -1 per atkbdc_isa.c:221-224, making the rman range [ULONG_MAX,ULONG_MAX] unsatisfiable, or under ISA IRQ exhaustion) the NULL resource reaches nexus_setup_intr() which panics by design (nexus.c:505-506). The BUS_SETUP_INTR return value is also ignored and the resource leaks on late failure, and atkbdresume() would dereference rman_get_start(NULL) (atkbd_isa.c:141). The sibling driver psm.c:2014-2022 performs both checks. No guest run: the trigger is privileged boot configuration (kernel config/loader hints) with no post-boot entry point, so no attacker-reachable runtime PoC exists; static proof chain is complete.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5179/VERDICT.md (static chain, 5 links); trigger.txt (privileged config); fix.diff (applies cleanly, patch -p1 --dry-run OK)",
  "kernel_refs": [
    "sys/dev/misc/atkbd/atkbd_isa.c:119",
    "sys/dev/misc/atkbd/atkbd_isa.c:120",
    "sys/dev/misc/atkbd/atkbd_isa.c:121",
    "sys/dev/misc/atkbd/atkbd_isa.c:141",
    "sys/dev/misc/atkbdc_layer/atkbdc_isa.c:221",
    "sys/kern/subr_bus.c:3303",
    "sys/platform/pc64/x86_64/nexus.c:505",
    "sys/dev/misc/psm/psm.c:2014"
  ],
  "poc_changes": "n/a (no seed PoC; trigger documented as privileged boot configuration in trigger.txt)",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (source-confirmed; no build required)",
  "run_cmd": "./run.sh (source-confirmed; see trigger.txt)",
  "code_hash": "9686f4f4d49e6a86d45c26916592b8f2e824b5b399babc0c18ebca38fbd7aa42",
  "notes": "QEMU guest not started: boot-config-gated path, nothing to exercise at runtime; family precedent (DF-2177/2178/2385) is source-confirmation. Guest left untouched.",
  "recommended_fix": "Check bus_alloc_legacy_irq_resource() for NULL (return ENXIO) and the BUS_SETUP_INTR() result (release the resource and return the error), mirroring psm.c:2014-2022.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored after source verification; verified to apply cleanly to a pristine copy (patch -p1 --dry-run OK). Kernel build/boot validation skipped: Low-severity boot-gated trigger would require editing the guests loader config and rebooting into a possibly console-less system.",
  "fix_evidence": "findings/poc/DF-5179/fix.diff (sha256 15fb54e0d7c0150cb4c53f7f843f8a8b3d7c4add384f5bf8e3d2bcebefafb019); dry-run apply check in VERDICT.md"
}