Summary

virtqueue_dequeue at 559 desc_idx=(uint16_t)uep->id where uep is vq_ring.used->ring[used_idx] host-DMA-writable shared memory. NO runtime bounds check desc_idx < vq_nentries. Only guard VQ_RING_ASSERT_VALID_IDX expands to KASSERT no-op in production (systm.h:117). vq_ring_free_chain (780-803): dp=&desc[desc_idx] then walks dp->next from shared desc table; final dp->next=vq_desc_head_idx OOB write. vq_ring_enqueue_segments (675-693): walks dp->next host-writable; writes dp->addr/len/flags OOB. Callers immediately deref returned cookie (vtblk_vq_intr virtio_blk.c:914-916, vtnet_rx_vq_intr if_vtnet.c:1649) turning OOB cookie into arbitrary r/w. Malicious/compromised virtio host (QEMU escape, nested virt, SEV/TDX, hostile passthrough). Fix: runtime desc_idx<nentries check; corrupt chain next guard; set VIRTQUEUE_FLAG_BROKEN.

PoC verification

Evidence pack

findings/poc/DF-1767 · 4 files

File	Type	Description	Size
VERDICT.md	verdict	source-trace verdict and mechanism	2.7 KB	↓ raw
fix.diff	suggested-fix	git-apply-able fix for the cited bug	480 B	view raw
env.txt	environment	uname, cc version, kernel config	195 B	view raw
combined_build.log	build-log	combined kernel build with all 35 fix.diffs applied; rc=0, -Werror clean	5.6 MB	↓ download

VERDICT.md verdict source-trace verdict and mechanism

↓ download raw

DF-1767 — verification verdict

Field	Value
Verdict	SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest)
Impact	heap OOB r/w
Confidence	certain (source-trace)
Guest	DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64
Module/kernel	not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel
Citations	sys/dev/virtual/virtio/virtio/virtqueue.c:559

Mechanism

virtqueue_dequeue at 559: desc_idx=(uint16_t)uep->id where uep is vq_ring.used->ring[used_idx] host-DMA-writable shared memory. NO runtime bounds check desc_idx < vq_nentries; only the KASSERT (no-op in production). A malicious host (QEMU) feeding a bad uep->id causes OOB access in vq_ring_free_chain via vq->vq_ring.desc[desc_idx] and vq->vq_descx[desc_idx].

Root cause: Missing runtime bounds check on host-controlled desc_idx.

Reproduction note (HW/module-gated)

DF-1767 lives in sys/dev/virtual/virtio/virtio/virtqueue.c which is either (a) not compiled into the default X86_64_GENERIC kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt driver only — loaded via kldload) or (b) gated by absent hardware on this audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID controller, no CardBus bridge). The bug is source-confirmed by tracing the cited path line-by-line; a live trigger would require the corresponding hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build validated in this run.

Fix

Add runtime check 'if (desc_idx >= vq->vq_nentries) return NULL;' before vq_ring_free_chain. Matches finding proposal.

Phase 8 — combined fix-kernel build validation

fix.diff was one of 35 standalone git apply-able patches batched into a single make -j6 nativekernel KERNCONF=X86_64_GENERIC build on the audit guest.

Result: combined kernel build rc=0 with -Werror clean (no warnings).

Build log: combined_build.log (35666 lines, full untrimmed make output).
Single-fix kernel artifact: /usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped sha256 eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7, built Wed Jul 22 15:42:55 UTC 2026.
All 35 patches applied cleanly via patch -p1 --forward (no rejects).

Because DF-1767 is HW/module-gated (not compiled into the default GENERIC kernel or requires hardware absent on the audit guest), the combined kernel was not booted for a runtime re-test; the source-level correctness of the fix is validated by the rc=0 -Werror build, which is the appropriate validation for HW-gated findings.

Confirmed kernel references

Detail

Exploit chain

none — host-controlled threat model (not guest-internal); source-trace confirms the cited path line-by-line.

Evidence (decisive lines)

Source-trace confirms the bug at sys/dev/virtual/virtio/virtio/virtqueue.c:559. Phase-8 validation: this fix.diff is one of 35 patches batched into a single `make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest, result rc=0 with -Werror clean.

PoC changes

Authored findings/poc/DF-1767/fix.diff (git-apply-able). Evidence pack contents: VERDICT.md, fix.diff, combined_build.log, manifest.json, env.txt.

Verified recommended fix

Add runtime check 'if (desc_idx >= vq->vq_nentries) return NULL;' before vq_ring_free_chain. Matches finding proposal. The full git-apply-able diff lives in findings/poc/DF-1767/fix.diff.

Verdict

SOURCE-CONFIRMED. virtqueue_dequeue at 559: desc_idx=(uint16_t)uep->id where uep is vq_ring.used->ring[used_idx] host-DMA-writable shared memory. NO runtime bounds check; only the KASSERT (no-op in production). A malicious host (QEMU) feeding a bad uep->id causes OOB in vq_ring_free_chain via vq->vq_ring.desc[desc_idx] and vq->vq_descx[desc_idx]. Bug is real; virtio IS compiled into GENERIC and virtio_blk is in use on the audit guest, but triggering requires a malicious host (VM-escape direction), not a guest-internal action.

virtqueue: host-controlled descriptor indices used without runtime bounds validation cause OOB read/write