β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-4514

ath_lna_div: dead ath_lna_div_ioctl() unconditionally copyouts uninitialized kernel heap (kmalloc without M_ZERO, executed even after EINVAL) - latent uninitialized-memory disclosure if ever wired up

Summary

Zero call sites tree-wide (the DF port never wired FreeBSD's dispatch), but the body is a landmine: ATH_DIAG_DYN allocates without M_ZERO, the empty switch yields EINVAL for everything, and the trailing copyout still executes - chosen-length uninitialized kernel-heap disclosure. Realistic wiring hazard given the diag ioctls themselves lacked priv checks (DF-4320). M_ZERO + copyout-on-success fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4514 Β· 1 files
FileTypeDescriptionSize
verdict.json file 953 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: Hyper-V/ath hardware absent from guest

fix in finding markdown
per-fix-DF-4514

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

kmalloc without M_ZERO + copyout executed even after the empty-switch EINVAL. M_ZERO + copyout-only-on-success fix.

Verdict

not_run: zero callers tree-wide; Info hardening