β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5231

Dead FPGA-diagnostics GPIO factory installs an all-NULL function table (create_* and both omitted define_*_registers): activating the unreachable MAXIMUS env would turn every GPIO operation into an immediate NULL function-pointer call

Summary

All-NULL hw_factory_funcs (incl. omitted define_*_registers) installed and reported usable; every gpio_service dispatch goes through it - first GPIO open would call address 0 (deterministic RIP=0 panic, no target control). Provably unreachable: IS_FPGA_MAXIMUS_DC gate needs DCE_ENV_FPGA_MAXIMUS but the sole producer hardcodes DCE_ENV_PRODUCTION_DRV (amdgpu_dm.c:424, grep-proven two assignment sites). Same latent hazard as hw_translate_diag twin; closes the gpio family record. Upstream deleted the FPGA path; minimal fix rejects a factory with NULL create_ddc_data.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5231 Β· 1 files
FileTypeDescriptionSize
verdict.json file 933 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5231

Confirmed kernel references

Detail

Evidence (decisive lines)

static reachability proof in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (Info hardening; provably unreachable trigger)