DF-2060 — PoC evidence pack

Finding: Invalid free / non-heap kfree in ath_ioctl_diag (ATH_DIAG_DYN + HAL_DIAG_REVS/FATALERR) Class: Free of memory not at start of buffer / invalid free (CWE-590) | Impact ceiling: panic | Confidence: certain

Status

SOURCE-CONFIRMED. The defect is verified real by line-by-line tracing of the audited sys/ tree, but it is HW/module-gated: the audit guest lacks the required hardware/module (Atheros (ath) WLAN NIC present; ATH_DIAGAPI compiled in; reachability ungated only because of DF-2059), so it cannot be triggered at runtime here. See VERDICT.md for the full mechanism and citations.

How to reproduce (on a guest that HAS the hardware)

1. Ensure the gating precondition is met: Atheros (ath) WLAN NIC present; ATH_DIAGAPI compiled in; reachability ungated only because of DF-2059.
2. Apply fix.diff to confirm the cited path changes; before the fix the cited code path exhibits the behaviour described in VERDICT.md.
3. The original finding markdown describes the runtime trigger.

Build validation (Phase 8)

fix.diff applies cleanly to pristine source. All nine findings' fixes were built together; see VERDICT.md "Phase 8" and fix_build.log:

make -j6 nativekernel KERNCONF=X86_64_GENERIC   # rc=0, -Werror, 0 warnings

Files

• VERDICT.md — full narrative, mechanism, citations, fix-build result
• fix.diff — standalone git apply-able fix (authored post-verification)
• fix_build.log — full combined-fix kernel build output (rc=0, -Werror)
• env.txt — guest environment for this verification
• manifest.json — machine-readable catalog

DF-2060 — VERDICT

Verdict: REPRODUCED (source-confirmed; HW/module-gated — not runtime-triggerable on this guest) Class: Free of memory not at start of buffer / invalid free (CWE-590) Impact ceiling: panic Confidence: certain

Reproduction status

This finding is HW/module-gated and could not be triggered at runtime on the audit guest. The guest has no Atheros NIC, no AdvanSys HBA, no Intel i915 GPU, no AMD Southern-Islands GPU, no LSI MegaRAID controller, and no loaded dm device (only vtnet0). The PoC therefore cannot reach the vulnerable path at runtime here. The bug is instead confirmed by line-by-line source tracing against the audited sys/ tree (master DEV, the same commit the kernel was built from) — the defect is real and deterministic given the hardware/module, which is the standard bar for HW-gated driver findings.

Mechanism (source-confirmed)

ath_ioctl_diag() allocates outdata via kmalloc(outsize,M_TEMP) when ATH_DIAG_DYN is set (:201), then passes &outdata to ath_hal_getdiagstate() (:214). For diagcode HAL_DIAG_REVS the HAL REPLACES *result with &AH_PRIVATE(ah)->ah_devid (ah.c:887) and for HAL_DIAG_FATALERR with &ah_fatalState[0] (ah.c:898) -- both interior pointers into the single kmalloc'd ath_hal struct. Cleanup at :232-233 does kfree(outdata,M_TEMP), freeing that interior/non-heap address -> slab panic (free of unallocated memory) or slab-metadata corruption on GENERIC (INVARIANTS). The original kmalloc buffer is also leaked. Trigger: ad_id=ATH_DIAG_DYN|HAL_DIAG_REVS or |HAL_DIAG_FATALERR.

Gating precondition: Atheros (ath) WLAN NIC present; ATH_DIAGAPI compiled in; reachability ungated only because of DF-2059

Exploit chain

Not applicable — this finding is HW/module-gated on the audit guest (no triggering hardware/module present), so no userspace-driven escalation chain can be exercised here. Per AGENT.md Phase 6 the valid hard blocker that applies is "vulnerable code path is reachable only on hardware/module absent from this guest." The realistic impact ceiling for the bug itself is panic as documented above (panic for the corruption-class bugs on default GENERIC with INVARIANTS ON; dos for the I/O-wedge/stall bugs; none/graceful-fallback for the validation-bypass and pure missing-check / resource-leak findings).

Fix (authored, git-apply-able)

Track the original kmalloc'd result buffer in a separate outbuf pointer and free outbuf (not the HAL-replaced outdata) on the cleanup path in ath_ioctl_diag() (if_ath_ioctl.c). This fixes both the invalid free and the buffer leak.

The standalone diff is fix.diff in this directory. It applies cleanly to the pristine audited source (git apply --check verified).

Phase 8 — combined fix-build validation

All nine findings' fixes were applied together to a single in-guest source tree and built with make -j6 nativekernel KERNCONF=X86_64_GENERIC. The DragonFly kernel compile invokes cc ... -Werror on every translation unit, so this is a true -Werror build.

• Result: === NK_DONE rc=0 === (full log: fix_build.log)
• Compiler errors in changed files: 0
• Compiler warnings (entire tree): 0
• Patched kernel.stripped sha256: 6086a989213ef7be890180f60edc0fd9827bf60efbc3ed8c969724746e250df6
• Baseline (unpatched) kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Because the PoC is HW/module-gated, the fix could not be runtime A/B tested on this guest (no way to trigger the bad behaviour on either the baseline or the patched kernel). The fix is therefore classified fix_status = not_testable (compile-validated + source-traced to close the cited path), which is the honest result for HW-gated findings.

Kernel references (verified during this trace)

• sys/dev/netif/ath/ath/if_ath_ioctl.c:201
• sys/dev/netif/ath/ath/if_ath_ioctl.c:214
• sys/dev/netif/ath/ath/if_ath_ioctl.c:232
• sys/dev/netif/ath/ath_hal/ah.c:887
• sys/dev/netif/ath/ath_hal/ah.c:898