⬢ DragonFlyBSD Kernel Audit
DF-5648 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-5648",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Live-proven on the audit guest across three independent boots: acpi_isab (sharing isab_devclass with this files isab driver) claims QEMUs ACPI Processor Container \\\\_SB_.CPUS (_HID=ACPI0010, _CID=PNP0A06) as isab0/isa0, so the real PIIX3 PCI-ISA bridge matched by isab_probe is silently renumbered to isab1/isa1 by devclass_alloc_units next-free-unit path, leaving a phantom empty ISA bus at unit 0 and misdirecting unit-0-targeted enumeration. On the stock kernel the consequence is purely cosmetic (real bus fully functional at isa1; negative-control experiment proves loader kenv hints are enumeration-inert on GENERIC, so no double enumeration can occur), and every input driving the topology is firmware/boot-config controlled (root-equivalent) \u2014 no unprivileged local, remote, or crafted-image path exists; filed as Info hardening for the unit-numbering/hint-misdirection hazard that is live on hint-compiled custom kernels.",
  "exploit_chain": "",
  "evidence": "run.log: dmesg lines isab0: <ACPI Generic ISA bridge> on acpi0 / isa0: <ISA bus> on isab0 (phantom, empty) vs isab1: <PCI-ISA bridge> at device 1.0 on pci0 / isa1: <ISA bus> on isab1 (real, hosts vga0+orm0); devinfo shows isab1@pci0:0:1:0 chip=0x70008086 class=0x060100 with children under isa1 only; run.2.log: hint.foo.0.at=\"isa\" present in kenv after reboot yet no foo child on either bus (resource_query_string walks only the compiled-in devtab) \u2014 negative control proving the double-enumeration variant is unreachable on GENERIC.",
  "kernel_refs": [
    "sys/bus/pci/isa_pci.c:60",
    "sys/bus/pci/isa_pci.c:84",
    "sys/bus/pci/isa_pci.c:86",
    "sys/bus/pci/isa_pci.c:100",
    "sys/bus/pci/isa_pci.c:113",
    "sys/bus/isa/isa_common.c:1046",
    "sys/dev/acpica/acpi_isab.c:93",
    "sys/kern/subr_bus.c:1072",
    "sys/bus/isa/isahint.c:121",
    "sys/kern/subr_bus.c:2402"
  ],
  "poc_changes": "No PoC code required \u2014 evidence class is live introspection. trigger.sh written fresh (no seed existed); added a negative-control kenv-hint injection experiment (run.2.log) that upgraded the double-enumeration claim from speculative to mechanism-proven-inert on GENERIC.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 640,
  "guest_dirty": 0,
  "build_cmd": "none (live introspection \u2014 no build)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root \"$(cat findings/poc/DF-5648/trigger.sh)\"",
  "code_hash": "9fd1aaf9220d750f14d840ac90308f02dd0a8268627944caf3b4de2361266a25",
  "notes": "Pass-2 checklist on sys/bus/pci/isa_pci.c: (a) probe consumes only fixed-width config reads (class/subclass/devid), attach is the trivial child-add (isa_common.c:1046-1054), bus methods are pure bus_generic_* pass-through, no resources claimed; (b) detach = bus_generic_detach (isa_pci.c:61) which PROPAGATES child veto and stops (subr_bus.c:2875-2877) and the driver owns no softc/IRQ/IO to tear down \u2014 NOT a DF-5544/5562/5598 instance; (c) no ivar methods, read-only pci accessors; (d) no config-space-supplied sizes (no BAR/ranges parsing; devid table is compile-time constants). Guest reset with-src performed after evidence capture.",
  "recommended_fix": "Guard isahint_identifys generic at isa enumeration to the first ISA bus (fix.diff); optionally have acpi_isab refuse Processor Containers or make isab_attach announce the unit renumber.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not applicable/not_testable: the findings impact on the stock kernel is none (negative control proves the hazard path enumeration-inert on GENERIC), so a single-fix kernel build has no observable security behavior to flip; fix.diff (git-apply-able, verified APPLIES-CLEAN) targets the only consequential variant \u2014 duplicate device instances from generic at isa hints on hint-compiled kernels \u2014 with a first-bus guard in isahint_identify.",
  "fix_evidence": "fix.diff verified with git apply --check against the pristine tree (sha256 2c2eb54e4e8e17c694337abbc9ebeb60aeb0fd1402544c86131ec6a3f603e93d); no kernel rebuild performed (see fix_verdict)."
}