β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5096

parser2 command-table helper hub failure ignored leaves bp->cmd_helper NULL inside a 'successfully' constructed firmware BIOS parser β€” latent whole-vtable NULL function-pointer call (v2 twin of DF-5075)

Summary

The hub correctly returns false for unmapped versions but bios_parser2.c:1987 ignores it and construct returns true - a live dc_bios with a NULL cmd_helper whose ~17 member calls in command_table2.c are all unguarded. On this build both DCN macros are force-defined so the only failing input (DCE_VERSION_UNKNOWN) triple-fails-closed at i2caux/gpio/res_pool before any BIOS command - strictly more locked than DF-5075, hence Info. Propagate-the-failure fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5096 Β· 1 files
FileTypeDescriptionSize
verdict.json file 927 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5096

Confirmed kernel references

Detail

Evidence (decisive lines)

source trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (hardware-gated: no AMD ASIC on guest; latent-by-analysis)