⬢ DragonFlyBSD Kernel Audit
DF-5188 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding": "DF-5188",
  "manifest": {
    "verdict": "untested (dead code — zero runtime reachability; latent hazards documented)",
    "impact": "latent: 8x heap OOB write + unbounded agp_memory leak if revived; none today",
    "confidence": "certain",
    "reproduce": {
      "build": "n/a — sys/dev/drm/drm/Makefile:110-112 excludes the file from every build",
      "run": "vm.sh run_root 'nm /boot/kernel/drm.ko | grep -ci agp_tt'  # -> 0",
      "expected": "0 agp_tt symbols in the shipped drm.ko; source checks: rg -n CONFIG_AGP sys/dev/drm/kconfig.h (no match); find sys -name agp.h (no asm/agp.h)"
    },
    "kernel_refs": [
      "sys/dev/drm/ttm/ttm_agp_backend.c:43",
      "sys/dev/drm/ttm/ttm_agp_backend.c:60",
      "sys/dev/drm/ttm/ttm_agp_backend.c:65-72",
      "sys/dev/drm/ttm/ttm_agp_backend.c:73",
      "sys/dev/drm/ttm/ttm_agp_backend.c:89-94",
      "sys/dev/drm/drm/Makefile:110-112",
      "sys/dev/agp/agpvar.h:100",
      "sys/dev/agp/agp.c:456-473",
      "sys/dev/drm/radeon/radeon_ttm.c:705,769,824"
    ],
    "artifacts": [
      "README.md",
      "VERDICT.md",
      "runtime_absence.log",
      "verdict.json"
    ]
  }
}