DF-2481

Divide-by-zero kernel panic via unchecked IOCFACTS RequestFrameSize

Summary

mpt_configure_ioc reads IOCFACTS into mpt->ioc_facts and immediately uses ioc_facts.RequestFrameSize as divisor through MPT_RQSL/MPT_NRFM/MPT_NSGL macros without validation. If RequestFrameSize=0 integer division by zero triggers #DE trap panicking kernel at adapter attach. RequestFrameSize is U16 from IOCFACTS reply DMAed by IOC. Attacker: malicious Thunderbolt/PCIe device malfunctioning HBA corrupt firmware. Trigger fires at device attach no authentication needed beyond physical access.

Discussion (0)

No comments yet.

Severity: Medium
Status: new
Bucket: Base system — drivers
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:N/A:H
CWE: CWE-369 Divide By Zero
File: sys/dev/disk/mpt/mpt.c
Lines: 2683-2694
Area: dev
Discovered: 2026-07-28
Updated: 2026-07-28

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-08-09 14:01:11
Attempts: 1
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: N/A (HW-gated driver finding)
Run cmd: N/A (HW-gated: target HBA not present)

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-08-09 14:01:11
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT #0 (unpatched with-src baseline — target driver not loadable on this guest)
fix.diff: findings/poc/DF-2481/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2481 · 6 files

File	Type	Description	Size
VERDICT.md	verdict	Source trace confirming DF-2481 bug is real but HW-gated	1.2 KB	↓ raw
fix.diff	suggested-fix	Validate RequestFrameSize != 0 before MPT_RQSL/NRFM/NSGL use	463 B	view raw
env.txt	environment	Guest gate proof: kldstat, pciconf, camcontrol (no target HBA)	1.1 KB	view raw
build.sh	build-script	No buildable PoC (HW-gated)	384 B	view raw
run.sh	run-script	Gate verification commands	411 B	view raw
README.md	readme	Overview of HW-gated finding	791 B	↓ raw

README.md readme Overview of HW-gated finding

↓ download raw

HW-gated SCSI/FC HBA driver finding

This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.

Reproduction status: NOT REPRODUCED (HW-gated)

The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
It cannot be triggered because the HBA hardware/driver does not exist on this guest.
A defense-in-depth fix.diff has been authored and validated with git apply --check.

Evidence

VERDICT.md — full source trace and analysis
env.txt — guest environment (kldstat, pciconf, camcontrol gate proof)
fix.diff — git-apply-able defense-in-depth fix
manifest.json — machine-readable catalog

VERDICT.md verdict Source trace confirming DF-2481 bug is real but HW-gated

↓ download raw

DF-2481 — Divide-by-zero via unchecked IOCFacts reply

Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

Hardware gate

No LSI Logic MPT (Fusion-MPT) HBA in guest: kldstat shows only kernel/ehci/xhci; pciconf -l shows no LSI device. The mpt driver does not attach.

Source trace (confirmed real bug)

File: sys/dev/disk/mpt/mpt.c:2683 (via macros at mpt.h:876-882)

mpt_configure_ioc reads IOCFACTS into mpt->ioc_facts and uses ioc_facts.RequestFrameSize as a divisor through the macros:

MPT_RQSL(mpt) = mpt->ioc_facts.RequestFrameSize << 2     // mpt.h:876
MPT_NRFM(mpt) = MPT_REQUEST_AREA / MPT_RQSL(mpt)          // mpt.h:882

At line 2683: mpt->max_seg_cnt *= MPT_NRFM(mpt); — if RequestFrameSize == 0, then MPT_RQSL == 0, and MPT_NRFM divides by zero, triggering #DE and panicking the kernel at adapter attach. RequestFrameSize is a U16 from the IOCFACTS reply, DMAed by the IOC — fully controlled by a malicious/faulty HBA.

Fix

Added RequestFrameSize == 0 validation before any use of MPT_RQSL. See fix.diff.

Impact (on HW that has the HBA)

Medium — kernel panic at device attach via malicious PCIe/Thunderbolt device.

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: target driver cannot attach (no target HBA). fix.diff validated with git apply --check (EXIT=0); fix is correct by source trace.

git apply --check findings/poc/DF-2481/fix.diff => EXIT=0. No runtime test possible (no target HBA).

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0 (unpatched with-src baseline — target driver not loadable on this guest)

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver code path dead at runtime on this guest: no target HBA). No unprivileged->root path.

Evidence (decisive lines)

kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no target HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2481/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh,README.md}. No PoC source (HW-gated).

Verified recommended fix

Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2481/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW-gated). The bug is REAL in source (traced line-by-line): mpt divide-by-zero via unchecked IOCFacts RequestFrameSize==0 (needs LSI MPT HBA). Gate confirmed: kldstat (only kernel+ehci+xhci; no isp/mpt/sili/trm/sbp module loaded), pciconf -l (no QLogic ISP/LSI MPT/SiliconImage/Tekram/FireWire HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM). The target driver cannot attach so the cited code path is dead at runtime on this guest.