β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-4393

Unbounded firmware-status spin and 20-second busy-wait in the OCR path execute in the watchdog callout while holding mfi_io_lock - single stuck firmware wedges softclock and all card I/O

Summary

The OCR path busy-waits 20 seconds then spins indefinitely on the RSR bit with no timeout; invoked from the reset holding mfi_io_lock in callout context - a firmware that never clears the bit parks the softclock thread forever with the lock held, permanently stalling all callouts system-wide. The neighboring reset sequencer bounds its waits, showing the omission is accidental. Bound-the-handshake fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4393 Β· 2 files
FileTypeDescriptionSize
README.md file 141 B ↓ raw
verdict.json file 870 B view raw
README.md file
↓ download raw

DF-4393

Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.

Fix: see pass-2 result block fix

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

see pass-2 result block fix

source-only
per-fix-DF-4393

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

source-only; path:line citations in pass-2 result block

Verdict

source-verified; hardware-gated