Off-by-one out-of-bounds read in CMI enum-value loop
Summary
acpi_hp.c:941 guard obj->Package.Count > valuebase+count. 970-972 loop for i=enumbase+1; i<enumbase+1+count. max i = enumbase+count = valuebase+1+count. When count = Count-valuebase-1: max i = Count -> Elements[Count] OOB by 1. Guard should use >= or add +1. /dev/hpcmi world-readable. OOB ACPI_OBJECT -> acpi_hp_get_string_from_object -> wild pointer deref (panic) or heap leak. BIOS-dependent: needs enum count == Count-valuebase-1. Fix: change > to >=.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1607 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Tighten the guard to Package.Count > valuebase + 1 + count so the loop's max ind | 556 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1607 — PoC Verification Verdict
Category: acpi_hp (module, ACPI/HW-gated)
Source: sys/dev/acpica/acpi_hp/acpi_hp.c:931-972
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-21
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
The CMI enumeration guard at line 941 checks Package.Count > valuebase + count, but the loop at line 970 iterates i up to enumbase+1+count = valuebase+2+count, accessing Elements[valuebase+1+count] which equals Count when the guard allows Count=valuebase+count+1. Off-by-one OOB element access.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller / AGP chipset) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not in the GENERIC kernel. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Tighten the guard to Package.Count > valuebase + 1 + count so the loop's max index stays in bounds.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying all 35 batch diffs and building a single X86_64_GENERIC kernel (rc=0, -Werror clean) — see fix_apply.log and the combined build log.
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): acpi_hp CMI enumeration guard checks Package.Count > valuebase+count but loop iterates up to enumbase+1+count = valuebase+2+count, accessing Elements[valuebase+1+count] = Ele
Verified recommended fix
REPRODUCED (source-only): acpi_hp CMI enumeration guard checks Package.Count > valuebase+count but loop iterates up to enumbase+1+count = valuebase+2+count, accessing Elements[valuebase+1+count] = Elements[Count]. OOB.
Verdict
REPRODUCED (source-only): acpi_hp CMI enumeration guard checks Package.Count > valuebase+count but loop iterates up to enumbase+1+count = valuebase+2+count, accessing Elements[valuebase+1+count] = Elements[Count]. OOB.
No comments yet.