⬢ DragonFlyBSD Kernel Audit
DF-5622 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5622",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static path certain, not triggerable on the audit guest. amd0f_set_fidvid() KKASSERTs (cpufreq_machdep.c:92/94) on values taken directly from the ACPI _PSS control value; the attach-time validator acpi_pst_amd0f_check_pstates() only kprintfs (never rejects) the first/last P-state entries (acpi_pstate_machdep.c:310-331) and never checks vid>=rvo (the rvo_mv%mvs_mv check at :361 is vacuous for the hard-enforced mvs==0), so a _PSS endpoint with vid<rvo panics the stock INVARIANTS GENERIC kernel (X86_64_GENERIC:56; KKASSERT==panic per sys/sys/systm.h:98-101) on any transition (powerd/boot/sysctl). Live KLD introspection (pstprobe.c) proves the guest cannot reach it: vendor=0x8086/GenuineIntel family 0xf, APMI 0x80000007 EDX=0, acpi_pst_md_probe()==NULL, while nm shows amd0f_set_fidvid @0xffffffff80bda6c0 compiled into the running kernel. No unprivileged trigger path exists (sysctl writes gated by SYSCAP_NOSYSCTL_WR, kern_sysctl.c:1446); the attacker is firmware/host, hence Low. No memory-corruption primitive: the file has no pointers, arrays, or copyout.",
  "exploit_chain": "",
  "evidence": "run.log lines: pstprobe: cpu_vendor_id=0x8086 ... APMI(0x80000007) edx=0 + acpi_pst_md_probe() = NULL ... UNREACHABLE + amd0f_set_fidvid=0xffffffff80bda6c0; env.txt: X86_64_GENERIC line 56 options INVARIANTS (running kernels config); VERDICT.md full line-by-line trace; fix.diff git-apply-clean and compile-validated on the guest (fixbuild.log RC=0).",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/cpufreq_machdep.c:91-95",
    "sys/platform/pc64/x86_64/cpufreq_machdep.c:78",
    "sys/platform/pc64/acpica/acpi_pstate_machdep.c:310-331",
    "sys/platform/pc64/acpica/acpi_pstate_machdep.c:353-365",
    "sys/platform/pc64/acpica/acpi_pstate_machdep.c:370-388",
    "sys/sys/systm.h:98-101",
    "sys/config/X86_64_GENERIC:56",
    "sys/kern/kern_sysctl.c:1446"
  ],
  "poc_changes": "No seed PoC existed. Authored pstprobe.c KLD harness: calls the real exported acpi_pst_md_probe() (pure CPUID/global reads, deliberately zero MSR access) to live-prove the reachability gates and dump the compiled-in amd0f symbol addresses; avoided calling amd0f_* directly because their entry rdmsr(0xc0010042) would #GP on this Intel-vendor guest (DF-5484 class) before reaching the asserted lines.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /root/pstprobe && make  (KMOD=pstprobe, bsd.kmod.mk, cc -Werror -D_KERNEL -nostdinc)",
  "run_cmd": "kldload /root/pstprobe/pstprobe.ko && dmesg | grep pstprobe",
  "code_hash": "12eb9dd9a0ae2860938ae1f60d5ecd0e9847af6c0ee73e6069cbe39bc573efe7",
  "notes": "Guest was dirtied during verification (pstprobe.ko loaded - module has no unload handler by design; /root/pstprobe and /root/fixcheck staged); vm.sh reset with-src performed before return. File is ALIVE code (platform/pc64/conf/files:149 standard), NOT part of the dead #ifdef notyet legacy CPU attachment (sys/bus/pci/x86_64/legacy.c:233-347, DF-5572) - its only consumer is the ACPI P-state machdep. The #GP-on-wrmsr/rdmsr-of-unimplemented-MSR class for this file (0xc0010041/0xc0010042 under a CPUID-lying VMM) is deliberately NOT re-filed: it is the already-recorded DF-5484 class from the sibling acpi_pstate_machdep.c.",
  "recommended_fix": "Replace both KKASSERTs in amd0f_set_fidvid() with return-EINVAL validation, and hard-reject (EINVAL) _PSS endpoint entries with FID/VID outside the MSR-derived [fv_min,fv_max] envelope in acpi_pst_amd0f_check_pstates() instead of kprintf-only.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (KKASSERT->EINVAL in cpufreq_machdep.c:91-95) is git-apply-clean against the pristine sys/ tree and the patched TU compiles warning-free with the guests kernel toolchain (fixbuild.log, RC=0). Full A/B fix validation not testable: the baseline panic requires AMD family-0F hardware plus a crafted _PSS, which this Intel-vendor KVM guest cannot present (live-proven; see VERDICT.md).",
  "fix_evidence": "fixbuild.log (cc -Werror ... -c cpufreq_machdep.c, RC=0); git apply --check output APPLY_CHECK_OK recorded in VERDICT.md; fix.diff hunk @@ -84,13 +84,17 @@."
}