Summary

nvme_admin_state_identify_ns at 673 j=NVME_FLBAS_SEL_GET(idns.flbas) masks 0..15 in bounds for lba_fmt[16]; 675 nsc->blksize = 1 << lbafmt->sect_size signed shift on device-DMA-controlled uint8_t NO validation. sect_size with low 5 bits==31 (31,63,95,...) -> blksize=0x80000000 (2GB). nvme_disk_attach at nvme_disk.c:104 cap_gb=idns.size/(1024*1024*1024/blksize): inner 1GB/2GB=0 -> outer /0 -> #DE trap panic. NVMe spec lbads must be 0 or 9..36. Malicious NVMe controller PCIe/Thunderbolt/qemu. Fix: validate sect_size in 9..16; use 1U<<; guard blksize division.

PoC verification

Evidence pack

findings/poc/DF-1812 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.1 KB	↓ raw
fix.diff	suggested-fix	Fix: Validate sect_size in range 9..16; use 1U<<; guard blksize division.	471 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1812 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/disk/nvme/nvme_admin.c:675

Mechanism: nsc->blksize = 1 << lbafmt->sect_size uses signed shift on device-DMA-controlled uint8_t with no validation. sect_size≥31 → overflow/divide-by-zero panic later.

Hardware dependency: Requires malicious NVMe controller (PCIe/Thunderbolt/qemu).

Fix: Validate sect_size in range 9..16; use 1U<<; guard blksize division.

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/disk/nvme/nvme_admin.c:675 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/disk/nvme/nvme_admin.c:675. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: 1<<sect_size signed shift on device-DMA uint8_t, no validation. Validate 9..16; use 1U<<.

Verified recommended fix

See fix.diff. 1<<sect_size signed shift on device-DMA uint8_t, no validation. Validate 9..16; use 1U<<.

Verdict

REPRODUCED (source-only). sys/dev/disk/nvme/nvme_admin.c:675: 1<<sect_size signed shift on device-DMA uint8_t, no validation. Validate 9..16; use 1U<<.

nvme_admin: unvalidated NVMe namespace LBA sect_size causes divide-by-zero panic at attach