⬢ DragonFlyBSD Kernel Audit
DF-5499 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5499",
  "status": "not_reproduced",
  "verdict": "passioctl() (scsi_pass.c:451-456) runs CAMIOCOMMAND with no cam_periph_acquire() while blocking lock-dropped in cam_periph_getccb()/ccbwait()/mapmem \u2014 the DF-5273/DF-5327 hold/release class. Guest choreography (passsim rig: fake SIM LUN, blocked CAMIOCOMMAND thread, forced devfs close + AC_LOST_DEVICE) proved the refcount CANNOT reach 0 under an in-flight ioctl on DragonFly: the ioctl syscalls file reference defers d_close, vflush(FORCECLOSE) refuses busy device vnodes (console: vflush: Warning, cannot destroy busy device vnode; rig stat: refcount=1 flags=0 valid), and no revoke(2) exists. The UAF is therefore not reachable today; filed as Info hardening. Residual risk: devfs count_dev() is XXX NOT SMP SAFE (devfs_vnops.c:1147-1148) and any future revoke/early-d_close would turn the missing reference into a premature camperiphfree() under live ioctl threads (dangling ccb_h.path on outstanding CCBs, dangling saved_ccb_ptr into softc).",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "exploit_chain": "",
  "evidence": "console.log (refcount=1 after umount -f with T1 blocked in CAMIOCOMMAND), run_full.log (stage output), VERDICT.md narrative; kernel refs scsi_pass.c:451-456, cam_periph.c:846-872, cam_periph.c:573-631, devfs_vnops.c:1139-1171",
  "kernel_refs": [
    "sys/bus/cam/scsi/scsi_pass.c:451",
    "sys/bus/cam/scsi/scsi_pass.c:490",
    "sys/bus/cam/scsi/scsi_pass.c:577",
    "sys/bus/cam/cam_periph.c:846",
    "sys/bus/cam/cam_periph.c:863",
    "sys/bus/cam/cam_periph.c:573",
    "sys/bus/cam/cam_periph.c:629",
    "sys/vfs/devfs/devfs_vnops.c:1146"
  ],
  "poc_changes": "Built passsim KLD rig (hang/lost/poison/complete/stat sysctls) modeled on DF-5375 targsim; stage-driven poc5499 with periph-refcount instrumentation because the original one-shot choreography could not observe the refcount; sset helper because DragonFly sysctl(8) refuses PROC oids.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 480,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC; cc -O0 -g -pthread -o poc5499 poc5499.c)",
  "run_cmd": "sh run.sh",
  "code_hash": "b282096c2c95f0820e8a402be4c7e7ccc27f9fcabe6153384fe5713f880b9f33",
  "notes": "Negative result with proof: forced devfs close cannot fire d_close under an in-flight ioctl on DragonFly; bug shape real (every sibling entry holds), impact blocked. main-thread killlwps wedge in earlier runs was SIGHUP noise, not kernel state.",
  "recommended_fix": "Take cam_periph_acquire()/release() around the passioctl switch (fix.diff).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Not built: Info-tier hardening; no observable behavior changes since the protected release path cannot currently trigger.",
  "fix_evidence": ""
}