DF-4748 — PoC evidence pack (verbatim-code rig)

Use-after-free of amdgpu_dm_connector via stale dc_sink->priv: sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:197/289/317 dereference stream->sink->priv after the connector was freed by the MST unplug path; the sink stays alive holding the dangling back-pointer because the enabled dc_stream_state keeps its own sink reference.

Status: REPRODUCED (verbatim rig; hardware-gated in-kernel)

The audit guest has no AMD GPU (Bochos stdvga only, no /dev/dri), so the finding is verified with the proven verbatim-code rig (DF-4165/4247/4631 evidence class):

1. Build (on the DragonFly guest):

scp -r rig fix.diff dfbsd:/root/df4748/    # or tar
ssh dfbsd 'sh /root/df4748/rig/build.sh /usr/src'
# -> regenerates the slices FROM /usr/src, verifies all 66 VERBATIM
#    blocks byte-identical + fix.diff round-trip, builds rig_base
#    (verbatim production) and rig_fixed (verbatim + fix.diff)

2. Run (all scenarios, baseline then fixed, 3x deterministic):

ssh dfbsd 'sh /root/df4748/rig/run.sh'

3. Expected (see VERDICT.md for the full matrix): - baseline disable-guard: exit 77, RIG FAULT: addr=… INSIDE FREED allocation 'dm_dp_add_mst_connector' — USE-AFTER-FREE CONFIRMED (the mst_port member read at amdgpu_dm_helpers.c:199); - baseline disable-groom / enable-groom: exit 77, CONTROLLED-WRITE PROVEN — verbatim payload machinery writes at an attacker-chosen address; - disable-poison: exit 77 (wild pointer); - disable-stale/disable-zero: exit 0 (latent read — honest latency of the bug class); - fixed build: every scenario exit 0, victim byte-identical in groom (FIX_BLOCKED_WRITE).

Contents

• rig/ — the verbatim rig: gen_rig.sh (machine-extract), check_verbatim.sh (byte-identity proof, host + guest), mst_rig.c (harness), rig_shims.h/rig_types.h (infrastructure shims, no defect logic), generated slices, Makefile, build.sh, run.sh, full logs (build.log, run.log, run.2.log, run.3.log)
• fix.diff — one-line back-pointer clear in dm_dp_destroy_mst_connector (git-apply-able against sys/; validated A/B in the rig AND by a real amdgpu.ko module build on the guest)
• fix_build.log — real-module compile validation (pristine + patched)
• fix_run.log — fixed-build scenario matrix (all clean)
• verdict.json / manifest.json — machine verdict
• verify.sh + static_proof.log — original static chain proof (8/8, still valid)
• env.txt — guest environment (no GPU PCI device)

On-hardware procedure (for a machine with an AMD ASIC + MST dock)

Display active on an MST child monitor → unplug that monitor (dock stays connected) → let the session reconfigure (CRTC off / replug) → dm_helpers_dp_mst_* hit the freed connector; slab state decides crash-vs-corruption, per the rig's free-mode models.

DF-4748 — VERDICT

Status: reproduced (verbatim-code rig on the DragonFly guest; the in-kernel manifestation is hardware-gated — the audit guest has no AMD ASIC / DP MST hub, see env.txt). Impact: kernel memory corruption (UAF read + attacker-steered writes). Confidence: certain for the rig reproduction (byte-identical production code, deterministic, 3/3 runs), likely for on-ASIC manifestation (identical code, only the slab timing is unexercised).

What was run (DF-4165/4247/4631 verbatim-rig protocol)

rig/ machine-extracts the production code byte-identical from sys/ (66 verbatim blocks; rig/check_verbatim.sh re-verified them on the guest against /usr/src — the tree the running kernel was compiled from — and proves the fixed slice is exactly pristine + fix.diff):

• amdgpu_dm_helpers.c:137-172/182-266/281-305/307-338 — get_payload_table and the three dm MST payload helpers (deref sites :197/:289/:317)
• amdgpu_dm_mst_types.c:182-197/210-258/283-308/310-373/375-398 — connector destroy (kfree), get_modes (dc_sink->priv = aconnector :243), fake-encoder create, add connector, dm_dp_destroy_mst_connector
• dc_sink.c:34-104, dc.c:1750-1847, dc_stream.c:38-157 — the whole dc_sink/dc remote-sink/dc_stream refcount machinery
• dc_link.c:2322-2372/2374-2452/2454-2530/2630-2642 — update_mst_stream_alloc_table, allocate_mst_payload, deallocate_mst_payload, core_link_disable_stream
• drm_dp_mst_topology.c payload machinery (assign/put payload id, init_vcpi, allocate/reset/deallocate_vcpi, find_vcpi_slots, calc_pbn_mode, update_payload_part1/2, payload step1/2, validated-port walk, put_port)
• drm connector refcount plumbing (drm_connector.c:152-160 drm_connector_free, drm_mode_object.c get/put, drm_connector.h drm_connector_put, tree kref/refcount bodies, fixpt31_32.c math)

The harness (rig/mst_rig.c) drives the exact production sequences: plug (dm_dp_add_mst_connector → dm_dp_mst_get_modes → dc_link_add_remote_sink, sink refcount 2) → enable (dc_create_stream_for_sink, refcount 3) → unplug (dm_dp_destroy_mst_connector verbatim: refcount 3→1, held solely by the stream, connector kfree'd via drm_connector_put → drm_connector_free → dm_dp_mst_connector_destroy) → use (the display session reacting: core_link_disable_stream → deallocate_mst_payload → the helpers, with the OLD stream that still holds the sink alive).

Results (deterministic, 3/3 identical runs — run.log, run.2.log, run.3.log)

The stable pre-use state is printed by every scenario: sink alive (refcount 1, held by stream) with sink->priv = <freed connector> — i.e. the sink demonstrably OUTLIVES the connector with the never-cleared back-pointer dangling.

The bug (all path:line refs verified in-tree)

1. Set, never cleared. Sole assignment in the amd display tree: amdgpu_dm_mst_types.c:243 — dc_sink->priv = aconnector;
2. Deref sites. amdgpu_dm_helpers.c:197/289/317 — aconnector = stream->sink->priv;; the guard at :199 (!aconnector || !aconnector->mst_port) is value-only.
3. The free. dm_dp_destroy_mst_connector (mst_types.c:375-398) drops the list ref (dc_link_remove_remote_sink, dc.c:1823) and the connector's ref (dc_sink_release), then drm_connector_put → drm_connector_free → dm_dp_mst_connector_destroy (mst_types.c:182, kfree(amdgpu_dm_connector)). sink->priv is never nulled. (Ref correction vs the original filing: the MST-child free site is dm_dp_mst_connector_destroy at mst_types.c:193, not amdgpu_dm.c:3187 — that one is the non-MST connector destroy; both are raw kfrees, conclusion unchanged.)
4. The sink outlives the connector. The enabled dc_stream_state holds its own sink ref (dc_stream.c:66 construct → dc_sink_retain; released in destruct, dc_stream.c:112). After the unplug destroy the refcount is exactly 1 = the stream's (rig-asserted).
5. The use. Next commit touching the old stream: core_link_disable_stream (dc_link.c:2630) → deallocate_mst_payload (:2454) → helper :197/:199 — UAF read of the freed connector; with slab reuse (groom), the authored mst_port/port steer the verbatim payload machinery into attacker-chosen memory (controlled writes, proven both disable- and enable-path). Re-plug/enable path: allocate_mst_payload (:2374, caller core_link_enable_stream :2621).

Threat model

Malicious/flapping MST dock (DF-1837) or physical unplug racing the display session (DF-4631 — the radeon twin, triaged High/memcorrupt). No privilege boundary beyond owning the display session; the disable-path trigger (userspace reacting to an HPD by turning the CRTC off) is the NORMAL reaction to an unplug.

Fix validation (fix.diff, A/B + real module build)

• Rig A/B: the fixed build compiles the byte-identical pristine + fix.diff slice (checker-proven bidirectionally) and is CLEAN on every scenario, including groom (victim untouched). The fix NULLs dc_sink->priv in dm_dp_destroy_mst_connector before the refs drop; the helpers already early-return on NULL priv (:199).
• Real kernel module build: on the guest, pristine amdgpu.ko built (bsd.kmod.mk), then fix.diff applied (fuzz=0, hunk at 385) and the module rebuilt cleanly — amdgpu_dm_mst_types.o recompiled, amdgpu.ko relinked (fix_build.log). Tree reverted byte-exact afterwards (sha256 match with the read-only repo tree).

Honesty notes / limitations

• No AMD ASIC on the guest: the in-kernel manifestation (which slab the connector lands in, HPD interrupt timing) is unexercised. What IS exercised is the full production code path itself, byte-identical, with slab state modeled at the boundaries (guard/stale/zero/poison/ groom). The latent-mode results (stale/zero complete without faulting) honestly reflect that the bug often does NOT crash on first use — the severity comes from reuse, exactly as modeled by groom.
• Shims (documented in rig_shims.h/rig_types.h): allocator with free modes, locks, logging, atomics/bitops, DPCD/sideband transport, dm_helpers_parse_edid_caps (audited separately, killed candidates), the dc_link PBN math helpers (get_pbn_per_slot/get_pbn_from_timing, pure bandwidth arithmetic upstream of the defect), and minimized production-named carrier structs. No defect logic lives in a shim; the defect-relevant functions are verbatim.

Killed candidates (pass 2, from the original filing — unchanged)

get_payload_table OOB (bounded by max_payloads=4 < 6); proposed_vcpis NULL deref (parallel invariant); remote-sink EDID size (rejected >512 — the uncapped local-EDID path is DF-1837, folded there); parse_edid_caps copies (bounded); aux defer loop (off-file); read_local_edid !aconnector (unreachable on local sinks); dtn log truncation (bounded); display_color_depth default (latent-robustness only).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.