⬢ DragonFlyBSD Kernel Audit
DF-5735 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5735",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "hci_cmd_read_buffer_size (sys/netbt/hci_event.c:884) accepts max_acl_size=0 from an injected Command_Complete event with no lower bound (DF-5733 lens); verified on the guest that the units ACL MTU becomes 0 via the production event path. Every subsequent hci_acl_send (production call site l2cap_lower.c:204) enters a structurally-infinite fragmentation loop (m_split(m,0) keeps all data in the tail; plen -= 0) that transiently drains the GLOBAL mbuf pool (netstat -m: 1 requests for memory denied, 0.17s spin) and returns ENOMEM, blackholing all bt tx and starving concurrent network allocations; repeatable per write. Fix (reject max_acl_size==0) validated: poison completion is ignored (flag stays set, unit never enabled), sane completion accepted (max=64).",
  "exploit_chain": "",
  "evidence": "run.log: hci_max_acl_size = 0 <-- POISONED marker + hci_acl_send returned 12 + netstat before/after (7/146632, denied 0 -> 1) + 0.17s wall time; VERDICT.md: sink analysis (hci_link.c:566-583, uipc_mbuf.c m_split semantics); fix_run.log: completion NOT applied (flag still set) on patched build + sane completion accepted",
  "kernel_refs": [
    "sys/netbt/hci_event.c:869",
    "sys/netbt/hci_event.c:884",
    "sys/netbt/hci_link.c:560",
    "sys/netbt/hci_link.c:566",
    "sys/netbt/hci_link.c:582",
    "sys/netbt/l2cap_lower.c:204",
    "sys/kern/uipc_mbuf.c:2171"
  ],
  "poc_changes": "harness m_copyback2 was wrapped in no-op KKASSERT (never executed without INVARIANTS) - replaced with real error checks; this masked the spin on the first attempt (plen=0 -> zero iterations)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "cd /root/hcih && sh build.sh",
  "run_cmd": "kldload ./hci_event_harness.ko; sysctl hw.hcih_setup=1; sysctl hw.hcih_fire_mtupoison=1  (expect: POISONED marker, 0.17s stall, ENOMEM, netstat denied=1)",
  "code_hash": "ae2f62f4c20be60acc23b9b1155d56f1770ec2ec27bf4b068d1087a2e8f013be",
  "notes": "Same verbatim KLD rig as DF-5734 (shared harness.c/hci_stub.c). Allocator-bounded per call on this guest -> Medium not High. Window poisoning (num_acl_pkts=0xFFFF accepted unvalidated) noted in same handler.",
  "recommended_fix": "hci_cmd_read_buffer_size(): ignore the completion when letoh16(rp.max_acl_size) == 0",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "On the patched build the zero-MTU completion is rejected (completion NOT applied (flag still set) - BTF_INIT_BUFFER_SIZE never clears, hci_enable() never brings the unit up, no hci_acl_send possible on a zero-MTU unit) while a sane completion is accepted and applied (hci_max_acl_size = 64); guest alive throughout.",
  "fix_evidence": "fix_run.log (F2 FIXED RUN blocks: poison rejected + sane accepted)"
}