DF-4391
mfi_tbolt_alloc_cmd never checks request_desc_pool for NULL - failed kmalloc leads to near-NULL memset write on first command build
Summary
The alloc validates only the second kmalloc; if request_desc_pool fails while the pool-array succeeds, the setup loop stores cmd->request_desc = NULL + i and the first command issue memsets at address 16*index - a write into the unmapped low page, panicking the boot. Adjacent to but distinct from DF-1583 (the other pool's failure path + lock). Check-both + unwind fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4391 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | ↓ raw | |
| verdict.json | file | 843 B | view raw |
README.md
file
↓ download raw
DF-4391
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
see pass-2 result block fix
source-only
per-fix-DF-4391
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; hardware-gated
No comments yet.