DF-4392
mfi_process_fw_state_chg_isr dereferences sc->mfi_aen_cm before its NULL check - OCR with no AEN outstanding NULL-derefs (and uses an unvalidated pool index)
Summary
The OCR completion path kfrees and indexes through mfi_aen_cm BEFORE the NULL guard. mfi_aen_cm is NULL between AEN completion and re-registration and before the first AEN - a firmware fault triggering OCR in that window reads cm_data from ~0x0 and panics; any non-TBOLT-issued AEN would also index the pool at -1. Hoist-the-guard fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4392 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | ↓ raw | |
| verdict.json | file | 660 B | view raw |
README.md
file
↓ download raw
DF-4392
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
see pass-2 result block fix
source-only
per-fix-DF-4392
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; hardware-gated
No comments yet.