DF-1889

Timeout-detection mismatch in e1000_load_firmware FW-reset wait loop

Summary

e1000_load_firmware L508 for(i=0;i<(E1000_HI_COMMAND_TIMEOUT*2);i++) runs i to 1000 on timeout. L516 if(i==E1000_HI_COMMAND_TIMEOUT) checks i against 500. Correct comparison should be if(i==(E1000_HI_COMMAND_TIMEOUT*2)). When device never asserts E1000_ICR_MNG i reaches 1000 check evaluates false function fails to detect timeout proceeds to write firmware to unresponsive device. Conversely if device responds at iteration 500 success path incorrectly flagged as failure. E1000_HI_COMMAND_TIMEOUT=500 e1000_manage.h:81. LATENT: no in-tree caller invokes e1000_load_firmware exported e1000_manage.h:50. Root-only kernel-internal HAL. Fix: if(i==(E1000_HI_COMMAND_TIMEOUT*2)).

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE: CWE-835
File: sys/dev/netif/ig_hal/e1000_manage.c
Lines: 508-516
Area: dev
Discovered: 2026-07-20
Updated: 2026-07-20

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-07-23 18:17:27
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-07-23 18:17:27
Runtime: —
Kernel: combined build rc=0
fix.diff: findings/poc/DF-1889/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-1889 · 1 files

File	Type	Description	Size
manifest.json	file		401 B	view raw

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch

combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/dev/netif/ig_hal/e1000_manage.c:508: timeout-detection mismatch in FW-reset wait loop

Verified recommended fix

Source-confirmed at sys/dev/netif/ig_hal/e1000_manage.c:508: timeout-detection mismatch in FW-reset wait loop

Verdict

Source-confirmed at sys/dev/netif/ig_hal/e1000_manage.c:508: timeout-detection mismatch in FW-reset wait loop