⬢ DragonFlyBSD Kernel Audit
DF-5778 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-5778",
  "file": "sys/dev/drm/amd/display/dc/irq/irq_service.c",
  "pass": 2,
  "verdict": "untested",
  "impact": "none",
  "severity": "Info",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/df5778 && make SYSDIR=/usr/src/sys KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC",
    "run": "kldload /root/df5778/df5778_harness.ko; sleep 1; dmesg | grep DF5778; kldunload df5778_harness",
    "expected": "B1 RESULT: PASS (bounds 0..89, rejects 90+); B2 canaries PASS; B3 macro-off-by-one defused by dispatcher; B4 upstream v4.17 `>` accepts 90 vs DFly `>=` rejects; T1 svc->funcs (off+16) = 0 -> verbatim irq_service.c:165 has NO guard (latent NULL deref); T2/T3/T4 PASS; guest healthy, module unloads cleanly"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:53",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:82",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:160",
    "sys/dev/drm/amd/display/dc/irq/irq_service.c:165",
    "sys/dev/drm/amd/display/dc/core/dc.c:1673",
    "sys/dev/drm/amd/display/dc/core/dc.c:1690",
    "sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:398",
    "sys/dev/drm/amd/display/dc/dm_services.h:68"
  ],
  "artifacts": [
    "df5778_harness.c",
    "Makefile",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "VERDICT.md",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}