⬢ DragonFlyBSD Kernel Audit
DF-5618 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "finding_id": "DF-5618",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ig4_acpi.c:107-108 hardcodes sc->version = IG4_ATOM for every HID in ig4iic_ids[] under the false comment All the HIDs matched are Atom SOCs. INT33C2/INT33C3 are Haswell-LP LPSS and INT3432/3433 Broadwell (IG4_HASWELL per ig4_pci.cs own table for the same silicon), and 808622C1 is Apollo Lake (IG4_APL per ig4_pci.c:120-127). The mis-version skips version-gated handling in ig4_iic.c: the HSW-only IG4_GENERAL_SWMODE write (:513-519) on ACPI Haswell, HSW LTR (:522-526), and puts Apollo Lake outside the >=IG4_SKYLAKE branch (:527-532). Pass-2 checklist (a) twin-check: the ACPI glue has NO bzero-wipes-version bug (no bzero in this file; newbus allocates the softc zeroed, subr_bus.c:1953-1954) - the stored value is simply wrong for half the HIDs. Reproduced live: the DF-5617 planted-ACPI rig presented an INT33C2 (Haswell-HID) device and the guest kernel printed ig4iic0: version 1 (=IG4_ATOM) for it (febf_version_print.log), exactly as the source predicts. Functional mis-programming only - every ATOM-path register access is also valid on the mislabeled silicon - so Info severity.",
  "exploit_chain": "",
  "evidence": "febf_version_print.log lines: ig4iic0: <Designware I2C Controller> iomem 0xfebf0000-0xfebf01ff irq 0 on acpi0 followed by ig4iic0: version 1 type 00000000 params 00000000 general 00000000 comp_version 00000000 - INT33C2 (Haswell per ig4_pci.c:104) programmed as version 1 (IG4_ATOM, ig4_var.h:51).",
  "kernel_refs": [
    "sys/bus/smbus/ichiic/ig4_acpi.c:70",
    "sys/bus/smbus/ichiic/ig4_acpi.c:107",
    "sys/bus/smbus/ichiic/ig4_acpi.c:108",
    "sys/bus/smbus/ichiic/ig4_pci.c:104",
    "sys/bus/smbus/ichiic/ig4_pci.c:120",
    "sys/bus/smbus/ichiic/ig4_iic.c:513",
    "sys/bus/smbus/ichiic/ig4_iic.c:522",
    "sys/bus/smbus/ichiic/ig4_iic.c:527",
    "sys/kern/subr_bus.c:1953"
  ],
  "poc_changes": "Evidence captured with the DF-5617 planted-ACPI rig (QEMU -acpitable SSDT declaring a Device with _HID INT33C2 and _CRS Memory32Fixed 0xFEBF0000+0x200/IRQ0, kldload ig4); the version print is production ig4_iic.c:499 output.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "none (planted-ACPI rig; see ../DF-5617/build.sh)",
  "run_cmd": "QEMU_EXTRA=-acpitable file=ssdt_febf.aml dfbsd-qemu/vm.sh up; vm.sh run_root kldload ig4; vm.sh log",
  "code_hash": "ac0782d95990a2ccc8fc6c939294ba48c1be042fe2decdcd5d88616ff9ce85cd",
  "notes": "Info severity: functional mis-programming of version-gated init (HSW SWMODE / LTR families) on ACPI-enumerated Haswell/Broadwell/Apollo Lake silicon; no memory-safety consequence. Kin of DF-5600 (inverse direction: there a bzero wiped a correct version; here a wrong version is stored correctly).",
  "recommended_fix": "Select sc->version per matched HID (INT33C2/C3/INT3432/33 -> IG4_HASWELL, 808622C1 -> IG4_APL, 80860F41/AMDI*/APMC0D0F -> IG4_ATOM), mirroring ig4_pci.c:103-138; store it in ig4iic_acpi_probe() like ig4_pci.c does.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable",
  "fix_evidence": "Info-severity functional finding; no kernel build performed for the suggested HID->version mapping (no behavioral failure to A/B - the mis-programming is cosmetic at runtime on QEMU, where no real Haswell/APL silicon exists)."
}