β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-4513

vmbus: vmbus_msghc_wait_result blocks uninterruptibly with no timeout - a silent or malicious Hyper-V host permanently wedges device attach at boot (and later wedges vmbus_msghc_ctx_destroy/kldunload too)

Summary

wait_result spins in an uninterruptible timeout-less tsleep; vmbus_init calls it from attach for every offered protocol version - a host that never injects VERSION_RESP leaves boot asleep forever with zero console output. The same wait is inherited by get1, so later teardown also hangs: sticky wedge, no recovery short of hard reset. Availability twin of DF-1668 under the malicious-host model. Bounded-wait+ECOMM fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4513 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1004 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: Hyper-V/ath hardware absent from guest

fix in finding markdown
per-fix-DF-4513

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

Uninterruptible tsleep(0) in wait_result reached from attach for every protocol version; the same wait later wedges ctx_destroy/kldunload. Bounded-wait + ECOMM fix.

Verdict

not_run: requires a Hyper-V host that withholds VERSION_RESP (untrusted-cloud scenario)