β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-4571

missed_breadcrumb() forces intel_engine_dump() unconditionally ('|| 1' debug leftover): full engine state dump, including the DF-4246 over-reading ring hexdump path, runs from callout context every hangcheck period on production kernels

Summary

The '|| 1' is a port-local edit (upstream: plain GEM_SHOW_DEBUG(), which is 0 in production). Every missed-breadcrumb event - from the 1.5s hangcheck timer per affected engine - executes the heavyweight intel_engine_dump from softclock context regardless of debug settings: unthrottled multi-KB console/dmesg flooding plus repeated entry into the DF-4246 over-read path. Unpriv-triggerable (missed-irq syndrome under load). Drop-the-||-1 fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4571 Β· 1 files
FileTypeDescriptionSize
verdict.json file 959 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: no Intel GPU on guest

fix in finding markdown
per-fix-DF-4571

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

Port-local '|| 1' debug leftover (upstream: plain GEM_SHOW_DEBUG()). Unpriv workload with missed-irq syndrome triggers it. Drop-the-||-1 fix.

Verdict

not_run: Low severity + no Intel GPU on guest