⬢ DragonFlyBSD Kernel Audit
DF-5651 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-5651",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static-analysis finding (Info severity, no security impact): the memory-to-CPU affinity association compares the 32-bit memory ProximityDomain against the CPU entrys single ProximityDomainLo byte (acpi_srat.c:113,124-125), ignoring ProximityDomainHi[3] (actbl3.h:377) and the Type-2 x2APIC entries entirely (:118-120). Domains >= 256 either never match (range dropped, (not found), vm_numa_organize never called) or collide with an unrelated sockets low byte (pages organized under the wrong NUMA domain, vm_page.c:546-547). Downstream values are bounded (ApicId u8, physid mod cpu_topology_phys_ids), so this is a correctness/silent-NUMA-misdirection gap, not memory corruption. Not verified on the guest: the QEMU rig is single-socket (cpu_topology_phys_ids == 1, vm_numa_organize early-returns at vm_page.c:534) so no observable NUMA placement exists to misdirect.",
  "exploit_chain": "",
  "evidence": "README.md cites acpi_srat.c:112-113,124-125 (Lo-only compare), :118-120 (Type-0-only dispatch), actbl3.h:377 (ProximityDomainHi), vm_page.c:534-547 (bounded downstream use).",
  "kernel_refs": [
    "sys/platform/pc64/acpica/acpi_srat.c:112",
    "sys/platform/pc64/acpica/acpi_srat.c:113",
    "sys/platform/pc64/acpica/acpi_srat.c:118",
    "sys/platform/pc64/acpica/acpi_srat.c:124",
    "sys/contrib/dev/acpica/source/include/actbl3.h:377",
    "sys/vm/vm_page.c:534",
    "sys/vm/vm_page.c:547"
  ],
  "poc_changes": "No PoC authored (Info; single-socket rig cannot manifest NUMA misdirection).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 depth finding from the domain-association review requested in the checklist item (b).",
  "recommended_fix": "Compare full 20-bit domain (Hi[3]<<8|Lo) and handle ACPI_SRAT_TYPE_X2APIC_CPU_AFFINITY entries 32-bit domain and APIC ID.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Info-severity correctness gap; no fix build warranted (single-socket QEMU rig has cpu_topology_phys_ids==1 so vm_numa_organize is a no-op and misdirection is unobservable).",
  "fix_evidence": ""
}