Summary

ar5211GetDiagState HAL_DIAG_RFGAIN at 680-682: *result=&ahp->ah_gainValues; *resultsize=sizeof(GAIN_VALUES). GAIN_VALUES (ar5211.h:83-91) last field is const GAIN_OPTIMIZATION_STEP *currStep which after ar5211InitializeGainValues points into static const gainLadder.optStep[] in ar5211_reset.c. ath_ioctl_diag copyout (if_ath_ioctl.c:218) copies entire struct including 8-byte kernel rodata pointer to userland. No priv check on SIOCGATHDIAG path (ifioctl default no caps_priv_check; ieee80211_ioctl default no check; ath_ioctl_diag no check). Requires ATH_DIAGAPI (LINT64 not GENERIC). Variant of DF-1520/1521/1522 ath_hal SIOCGATHDIAG leak class. Fix: zero currStep before export or gate SIOCGATHDIAG behind SYSCAP_RESTRICTEDROOT.

PoC verification

Evidence pack

findings/poc/DF-1808 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.1 KB	↓ raw
fix.diff	suggested-fix	Fix: Zero currStep pointer before export in HAL_DIAG_RFGAIN case.	474 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1808 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680-682

Mechanism: HAL_DIAG_RFGAIN copies entire GAIN_VALUES struct including currStep kernel rodata pointer to userland via SIOCGATHDIAG. No priv check on the path.

Hardware dependency: Requires ATH_DIAGAPI (not in GENERIC) + ath(4) hardware.

Fix: Zero currStep pointer before export in HAL_DIAG_RFGAIN case.

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680-682 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680-682. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: HAL_DIAG_RFGAIN leaks rodata pointer via GAIN_VALUES struct. Zero currStep before export.

Verified recommended fix

See fix.diff. HAL_DIAG_RFGAIN leaks rodata pointer via GAIN_VALUES struct. Zero currStep before export.

Verdict

REPRODUCED (source-only). sys/dev/netif/ath/ath_hal/ar5211/ar5211_misc.c:680-682: HAL_DIAG_RFGAIN leaks rodata pointer via GAIN_VALUES struct. Zero currStep before export.

ar5211_misc: HAL_DIAG_RFGAIN ioctl leaks kernel rodata pointer via embedded currStep pointer in GAIN_VALUES