⬢ DragonFlyBSD Kernel Audit
DF-5249 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5249",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "The 16-slot sc->cmdq[] deferred-command ring is produced by 8 lockless sites that store .func BEFORE the argument fields (e.g. if_run.c:2370-2374, 4896-4897) and consumed by run_cmdq_cb() (1041-1068) with separate unordered loads; RUN_CMDQ_GET wraps at 16 outstanding commands. Torn publish yields func(NULL) - NULL deref in run_update_beacon_cb; wrap overwrite between consumer loads yields func_new(arg0_old) type confusion (run_key_set_cb with vap as run_cmdq*, cmdq->k loaded from vap memory -> wild deref); wrapped slots silently lose commands, e.g. a lost run_key_delete leaves a stale hardware key. All three interleavings demonstrated by cmdq_race.c on the guest (13k torn NULL-arg calls and 485k identity mismatches per 10 s under deliberate consumer lag). In-kernel repro hardware-gated -> inconclusive.",
  "exploit_chain": "beacon TIM churn + key updates + tx timeouts push >16 commands or preempt a producer between stores -> consumer calls run_update_beacon_cb(NULL) (panic) or run_key_set_cb(vap-as-cmdq) (wild pointer read feeding device register writes) -> kernel DoS / memory disclosure to device / stale-key crypto state",
  "evidence": "findings/poc/DF-5249/run.log (2x10s runs): torn NULL-arg calls 12011/13347, identity mismatches 470340/484744, wrap overwrites ~53M; producer store order verbatim from if_run.c",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_run.c:92",
    "sys/bus/u4b/wlan/if_run.c:1041",
    "sys/bus/u4b/wlan/if_run.c:2370",
    "sys/bus/u4b/wlan/if_run.c:4896",
    "sys/bus/u4b/wlan/if_run.c:2443",
    "sys/bus/u4b/wlan/if_run.c:2671",
    "sys/bus/u4b/wlan/if_run.c:3159",
    "sys/bus/u4b/wlan/if_run.c:3427"
  ],
  "poc_changes": "Harness written from scratch (no seed)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 27,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/cmdq_race /tmp/cmdq_race.c",
  "run_cmd": "/tmp/cmdq_race 10",
  "code_hash": "662b168a7b2c63df1d9638b9850a3df0cf6dede79b47665052d9d63ded39920d",
  "notes": "Harness consumer is deliberately lagged (100us) to make windows observable; production rates differ but reachability of each interleaving is what is proven. The DF-5248 drain-loop wedge is one realistic kernel-side delay source.",
  "recommended_fix": "Store cmdq slot .func last behind cpu_ccfence() at all producer sites; single structured consumer read",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the QEMU guest has no USB controller and no run(4) device model exists, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}