DF-4123 — parse_mipi_sequence: 1-byte heap OOB read of the kmemdup'd sequence blob when an element-END is the final byte

• File: sys/dev/drm/i915/intel_bios.c
• Lines: 1134-1158 Severity: Low Confidence: certain
• Status: reproduced (impact: leak) — hardware-gated crafted-VBIOS/firmware threat model; harness-reproduced on the DragonFly guest.

Summary

In parse_mipi_sequence() the loop at intel_bios.c:1134-1158 reads u8 seq_id = *(data + index) where data is an exact-size kmemdup'd buffer of seq_size bytes (intel_bios.c:1129). goto_next_sequence() returns the index just past an MIPI_SEQ_ELEM_END byte; if that byte is the LAST byte of the blob (a truncated-but-walk-consistent panel sequence), it returns exactly seq_size, and the next loop iteration reads data[seq_size] — one byte past the end of the heap allocation (slab OOB read). The byte read this way becomes a sequence id: if it happens to be MIPI_SEQ_END the loop stops; otherwise it indexes dsi.sequence[seq_id] and re-enters goto_next_sequence (which then returns 0 -> err path). 1-byte read; disclosed value only gates control flow into bounded paths.

Reproduce (harness)

./build.sh && ./run.sh — exit 77 = OOB/div0 confirmed by verbatim kernel code; -p run = proposed fix, exit 0.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

DF-4123 verdict — parse_mipi_sequence: 1-byte heap OOB read of the kmemdup'd sequence blob when an element-END is the final byte

Reproduced? — reproduced (leak)

Harness-reproduced: crafted BDB_MIPI_SEQUENCE (v1) whose panel sequence payload is [DEASSERT_RESET][GPIO elem, 3 bytes][ELEM_END as final byte] — the verbatim goto_next_sequence returns exactly seq_size=5 and the verbatim parse loop reads data[5] on a 5-byte guard-terminated buffer: SIGSEGV at exactly +5, exit 77, stable across 3 runs (run.log). In-kernel analog: 1-byte slab OOB read past kmemdup(seq_data, seq_size). Minimal standalone impact (single byte gating bounded control flow); filed as Low.

Root cause (path:line)

In parse_mipi_sequence() the loop at intel_bios.c:1134-1158 reads u8 seq_id = *(data + index) where data is an exact-size kmemdup'd buffer of seq_size bytes (intel_bios.c:1129). goto_next_sequence() returns the index just past an MIPI_SEQ_ELEM_END byte; if that byte is the LAST byte of the blob (a truncated-but-walk-consistent panel sequence), it returns exactly seq_size, and the next loop iteration reads data[seq_size] — one byte past the end of the heap allocation (slab OOB read). The byte read this way becomes a sequence id: if it happens to be MIPI_SEQ_END the loop stops; otherwise it indexes dsi.sequence[seq_id] and re-enters goto_next_sequence (which then returns 0 -> err path). 1-byte read; disclosed value only gates control flow into bounded paths.

Chain

crafted MIPI sequence blob ending in MIPI_SEQ_ELEM_END -> goto_next_sequence returns seq_size -> parse loop reads data[seq_size] -> 1-byte OOB read of exact-size kmemdup heap buffer

Kernel refs

• sys/dev/drm/i915/intel_bios.c:1129
• sys/dev/drm/i915/intel_bios.c:1134
• sys/dev/drm/i915/intel_bios.c:1135
• sys/dev/drm/i915/intel_bios.c:908
• sys/dev/drm/i915/intel_bios.c:919

Fix

Bail to the existing err path (which frees data and clears sequence[]) when the walker consumed the whole blob. Harness -p mode: loop stops at index==seq_size without reading (fix_run.log).

fix.diff applies cleanly against the read-only sys/ tree (2-file for DF-4125; note the radeon_pm.c hunk also needs dpm_failed_unlock: mutex_unlock(&rdev->pm.mutex); added to the existing dpm_failed label path — spelled out here since the label does not exist in the unfixed tree). Kernel-level fix validation is not possible on this guest (no i915/RV6xx devices; the drivers never attach in QEMU); harness-level fix validation IS included: the -p runs exercise the patched parse logic against the identical crafted input and exit 0 (fix_run.log).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.