⬢ DragonFlyBSD Kernel Audit
DF-5267 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5267",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "rt2860_rates[] (if_mtwreg.h:963-998) has exactly 36 entries (indices 0..35) and MTW_RIDX_MAX=36. Five lookup loops exit with ridx==MTW_RIDX_MAX when the searched rate is not in the table - mtw_media_change (1720-1723, rn->fix_ridx), mtw_iter_func (2320-2327, rn->amrr_ridx, e.g. an ni_txrate not among the 36 codes), mtw_newassoc (2394-2396, mn->mgt_ridx), mtw_sendprot (3349-3351) and mtw_tx_param (3428-3430) (data->ridx). The stored ridx is later used to index rt2860_rates[ridx] one element past the end: mtw_tx (3115-3122, ctl_ridx), mtw_set_tx_desc (2998-3034, .mcs/.phy), mtw_tx_mgt (3258, .rate) and the tx callbacks radiotap tap->wt_rate = rt2860_rates[data->ridx].rate (2846) which leaks the adjacent static bytes to any radiotap listener. One-element OOB read of a const array (adjacent rodata), impact is a 1-2 byte info leak of static data plus wrong hardware fields; a miss requires an off-table rate (e.g. odd ni_txrate), hence speculative. Twin of DF-0984 (urtwn ridx2rate).",
  "exploit_chain": "node with ni_txrate not in rt2860_rates -> amrr_ridx=36 -> data->ridx=36 -> rt2860_rates[36] OOB read -> value lands in TXWI MCS field and radiotap wt_rate (bpf listeners)",
  "evidence": "Code-cited: 5 loops + 4 use sites; array size counted (36 entries). untested (hardware-gated)",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtw.c:1720",
    "sys/bus/u4b/wlan/if_mtw.c:2320",
    "sys/bus/u4b/wlan/if_mtw.c:2998",
    "sys/bus/u4b/wlan/if_mtw.c:3115",
    "sys/bus/u4b/wlan/if_mtw.c:2846",
    "sys/bus/u4b/wlan/if_mtwreg.h:963",
    "sys/bus/u4b/wlan/if_mtwreg.h:1008"
  ],
  "poc_changes": "",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "Clamp ridx to MTW_RIDX_CCK1 after each miss",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}