⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1938

Write-reply stack overflow via self-comparing bound check in read_channel_reply (cross-file with DF-1868)

Summary

read_channel_reply dce110:316 if(bytes_replied>size)return -1 compares freshly-read 5-bit AUX_SW_REPLY_BYTE_COUNT against caller-provided reply->length which in write path is same HW field assigned aux_engine.c:419 no check against DEFAULT_AUX_MAX_DATA_SIZE=16. Self-comparison degenerates to (HW_count_fresh-1)>(HW_count_prev-1) almost always false. Write loop dce110:319-325 writes up to 30 bytes into reply_data[16] aux_engine.c:328 -> up to 14-byte stack overflow. Actual OOB write occurs at THIS file dce110:323 buffer[i]=aux_sw_data_val. Read path safe aux_engine.c:196 checks returned_byte>current_read_length against caller buffer. Same vuln as DF-1868 filed against aux_engine.c upper layer; dce110 is lower layer where OOB manifests. Defense-in-depth fix: clamp bytes_replied against DEFAULT_AUX_MAX_DATA_SIZE before write loop. Malicious DP peripheral responds to AUX write with ACK+30 data bytes -> HW latches 31 -> SW overflow.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1938 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 820 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1938 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:316-323. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

amd display DC (not in GENERIC, no AMD HW). Source: read_channel_reply at L316 if(bytes_replied>size)return -1 compares freshly-read 5-bit HW AUX_SW_REPLY_BYTE_COUNT against caller-provided reply->length which in the write path (aux_engine.c:419) is the same HW field assigned without bound check against DEFAULT_AUX_MAX_DATA_SIZE. Self-comparing guard is moot when both come from the same HW register that can be up to 31.

Clamp bytes_replied to DEFAULT_AUX_MAX_DATA_SIZE before the size comparison.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1938/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Clamp bytes_replied to DEFAULT_AUX_MAX_DATA_SIZE before the size comparison. Full git-apply-able diff in findings/poc/DF-1938/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/amd/display/dc/i2caux/dce110/aux_engine_dce110.c:316-323. amd display DC (not in GENERIC, no AMD HW). read_channel_reply L316 if(bytes_replied>size)return -1 compares freshly-read 5-bit HW AUX_SW_REPLY_BYTE_COUNT against caller-provided reply->length which in the write path (aux_engine.c:419) is the same HW field assigned without bound check. Self-comparing guard is moot when both come from the same HW register (can be up to 31). HW gated.