⬢ DragonFlyBSD Kernel Audit
DF-5187 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5187",
  "status": "untested",
  "verdict": "Latent mis-wiring, code-verified, not exercised: the DEFAULT drm_gem_dumb_map_offset (drm_dumb_buffers.c:128 -> drm_gem.c:401) returns the raw vma-offset-manager address (no DRM_GEM_MAPPING_KEY bits, drm_gem.c:119-160) while the DragonFly DRM mmap resolver drm_gem_object_from_offset (drm_gem.c:1063-1080) only accepts KEY|OFF(idxunr-hash-key) offsets resolved via the legacy offset_hash - a disjoint allocator. Any driver relying on the default hands out offsets that mmap() rejects with ENODEV, and the two offset namespaces disagree on object identity. All three in-tree KMS drivers override .dumb_map_offset (amdgpu_drv.c:1322, i915_drv.c:3301, radeon_drv.c:693), so no in-tree path uses the default; the audit guest additionally has no DRM device. One-line fix mirrors i915s working form (fix.diff). Info severity.",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full path trace with line cites); fix.diff (one-line correction matching i915_gem.c:2647-2648)",
  "kernel_refs": [
    "sys/dev/drm/drm_dumb_buffers.c:120-129",
    "sys/dev/drm/drm_gem.c:381-406",
    "sys/dev/drm/drm_gem.c:1063-1080",
    "sys/dev/drm/drm_gem.c:119-160",
    "sys/dev/drm/i915/i915_gem.c:2647-2648"
  ],
  "poc_changes": "n/a (Info finding, no PoC attempted per Phase V skip rule for Low/Info)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "Filed to document the ports dual offset namespaces - the same architectural split that empowers DF-5186s wrong-object resolution.",
  "recommended_fix": "Return DRM_GEM_MAPPING_OFF(obj->map_list.key) | DRM_GEM_MAPPING_KEY from drm_gem_dumb_map_offset (see fix.diff)",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Not applicable - latent dead-in-tree path; nothing to A/B on this guest.",
  "fix_evidence": "fix.diff"
}