⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-4176

iir_timeout is an empty handler: SCSI timeouts never abort, retry, or complete — timed-out CCBs hang forever; also references an undeclared identifier under GDT_DEBUG

Summary

gdtexecuteccb arms a callout to iir_timeout, but the body is only a GDT_DPRINTF - no abort, no retry, no xpt_done, no gdt_next. A controller that never completes a command leaves the CCB queued forever (CAM recovery never fires), hanging all I/O to that device. Additionally the DPRINTF argument references the undeclared 'gccb', so the file cannot even compile with GDT_DEBUG - the handler was never debug-build-tested. Implement-the-handler fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4176 · 2 files
FileTypeDescriptionSize
README.md file 141 B ↓ raw
verdict.json file 750 B view raw
README.md file
↓ download raw

DF-4176

Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.

Fix: see pass-2 result block fix

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

see pass-2 result block fix

source-only
per-fix-DF-4176

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

source-only; full path:line trace in pass-2 result block

Verdict

source-verified; hardware-gated (no iir controller / no Qlogic HBA on audit guest)