β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5232

dml_init_instance's default branch is ASSERT-only (WARN_ON) and still commits lib->project with no bounding box loaded β€” latent invalid-state commit that would feed the dml_log2(0)/Γ·0 family (DF-4198) if a future project value lacks a case

Summary

set_soc_bounding_box/set_ip_params default branches only WARN_ON and fall through; dml_init_instance unconditionally commits lib->project and returns void - success-by-construction. A future enum member without a case yields all-zero boxes (kzalloc dc) driving dml_log2(0) UB-shift and zero-buffer arithmetic in the RQ/DLG math (same terminal family as DF-4198). Dead today: enum has only UNDEFINED/RAVEN1 and the sole caller passes the RAVEN1 constant. total-or-fail bool fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5232 Β· 1 files
FileTypeDescriptionSize
verdict.json file 921 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5232

Confirmed kernel references

Detail

Evidence (decisive lines)

static reachability proof in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (Info hardening; provably unreachable trigger)