Summary

evdev_mt_record_event SYN_MT_REPORT at 416-424 KASSERT(mt->type_a) no-op production (systm.h:117-118); mt->match_frame |= 1U << mt->match_slot; mt->match_slot++ NO upper bound. Cdev write path forwards SYN_MT_REPORT straight through evdev_push_event whenever EVDEV_FLAG_MT_TRACK set. Replay loop 463-467 FOREACHBIT match_frame: mt->match_slots[size]=mt->match_slots[slot] for each bit set -> OOB heap read+write past match_slots[slots] (sized at 129). evdev_mt_match_frame KKASSERT(size<=MAXIMAL_MT_SLOT+1) at 329 panics INVARIANTS; production drives evdev_mt_matching past matrix[(slots+6)*slots] (130). /dev/input/eventN 0600 root:wheel. In-tree only psm.c sets EVDEV_FLAG_MT_TRACK (Synaptics capReportsV, PSM_FINGERS=2 slots=2 matrix=16 ints). ABS_MT_SLOT=1 + 3 SYN_MT_REPORT + SYN_REPORT -> match_frame=0xE bits 1,2,3. Fix: runtime if(!mt->type_a) return; if(match_slot<0||match_slot>MAXIMAL_MT_SLOT) return.

PoC verification

Evidence pack

findings/poc/DF-1825 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.2 KB	↓ raw
fix.diff	suggested-fix	Fix: Add runtime bounds check: if(!mt->type_a) return; if(match_slot out of range) re	527 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1825 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/misc/evdev/evdev_mt.c:420-422

Mechanism: evdev_mt_record_event SYN_MT_REPORT increments match_slot with no upper bound. KASSERT(type_a) is no-op in production. Replay loop OOB read/write past match_slots[].

Hardware dependency: Requires /dev/input/eventN with EVDEV_FLAG_MT_TRACK (only psm.c sets it).

Fix: Add runtime bounds check: if(!mt->type_a) return; if(match_slot out of range) return.

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/misc/evdev/evdev_mt.c:420-422 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/misc/evdev/evdev_mt.c:420-422. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: SYN_MT_REPORT match_slot++ no bound → OOB heap r/w. Add runtime bounds check.

Verified recommended fix

See fix.diff. SYN_MT_REPORT match_slot++ no bound → OOB heap r/w. Add runtime bounds check.

Verdict

REPRODUCED (source-only). sys/dev/misc/evdev/evdev_mt.c:420-422: SYN_MT_REPORT match_slot++ no bound → OOB heap r/w. Add runtime bounds check.

evdev_mt: unbounded match_slot in SYN_MT_REPORT path causes OOB heap read/write and KKASSERT panic