⬢ DragonFlyBSD Kernel Audit
DF-5623 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-5623",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Loop-structure analysis certain, hang not triggerable on the audit guest. AMD0F_WAIT_FIDVID_CHG (cpufreq_machdep.c:53-56, used at :102/:112/:138/:146/:157) busy-waits on the FID/VID_STATUS pending bit with no bound, and the phase-2 VCO ramp loop (:126-142) terminates only if hardware actually moves cfid toward the target; success is returned unconditionally (:161) without verifying cfid/cvid reached fv. A stuck-pending or write-ignoring K8 (failing VRM, or a VMM consuming WRMSR 0xc0010041 but leaving STATUS inert) wedges the cpuhelper CPU at kernel priority while the initiator blocks forever holding dom->pd_serialize (acpi_cpu_pstate.c:994-996, :1452-1465) - a system-wide hard hang reachable unattended via powerd or the (root-only) pstate sysctls. Live KLD introspection (pstprobe.c, shared with DF-5622) proves the path is gated OFF on this guest (vendor Intel, APMI EDX=0, acpi_pst_md_probe()=NULL) though compiled into stock GENERIC, and the entry rdmsr (cpufreq_machdep.c:78) would #GP here first (DF-5484 class). Hardware/fault-preconditioned and root/firmware-initiated only -> Info hardening; no memory-corruption primitive.",
  "exploit_chain": "",
  "evidence": "run.log: pstprobe gate lines (vendor/Apmi/probe-NULL/symbol addresses); build.log: harness -Werror build; fixbuild.log RC=0 for the patched TU; VERDICT.md traces both loops and the cpuhelper/serializer wedge mechanics with path:line.",
  "kernel_refs": [
    "sys/platform/pc64/x86_64/cpufreq_machdep.c:53-56",
    "sys/platform/pc64/x86_64/cpufreq_machdep.c:126-142",
    "sys/platform/pc64/x86_64/cpufreq_machdep.c:161",
    "sys/dev/acpica/acpi_cpu_pstate.c:994-996",
    "sys/dev/acpica/acpi_cpu_pstate.c:1452-1465",
    "sys/kern/kern_sysctl.c:1446"
  ],
  "poc_changes": "No seed PoC existed. Reuses the DF-5622 pstprobe.c KLD introspection harness (safe: no MSR access) - on this guest the only honest evidence class is live reachability introspection, since exercising the loops requires AMD-0F hardware with non-converging FID/VID.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 180,
  "guest_dirty": 0,
  "build_cmd": "cd /root/pstprobe && make  (KMOD=pstprobe, bsd.kmod.mk, cc -Werror -D_KERNEL -nostdinc)",
  "run_cmd": "kldload /root/pstprobe/pstprobe.ko && dmesg | grep pstprobe",
  "code_hash": "12eb9dd9a0ae2860938ae1f60d5ecd0e9847af6c0ee73e6069cbe39bc573efe7",
  "notes": "Guest dirtied during verification (KLD + staged files); vm.sh reset with-src performed before return. Linux powernow-k8 bounds its transition wait and bails out with an error - the reference design for fix.diff. DELAY worst-cases are bounded and fine (VST<=127*20us, IRT<=80us per step); only the two flagged constructs are unbounded.",
  "recommended_fix": "Bound AMD0F_WAIT_FIDVID_CHG (bail out with ETIMEDOUT at all 5 call sites on stuck pending), bound the phase-2 ramp loop, and verify cfid/cvid convergence before returning 0.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (bounded spin macro + ETIMEDOUT at call sites + nloop-bounded phase-2 loop + convergence kprintf) is git-apply-clean and compiles warning-free with the guests kernel toolchain (fixbuild.log RC=0). Runtime A/B not testable: the baseline hang requires non-converging AMD-0F FID/VID hardware absent from this guest.",
  "fix_evidence": "fixbuild.log (cc -Werror ... -c cpufreq_machdep.c RC=0 for the DF-5623-patched variant); git apply --check APPLY_CHECK_OK; fix.diff hunks @ -53,4 +53,7 / -70-71 / -102/-112/-138/-146/-157 waits / -126 loop / -155-161 convergence."
}