β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5270

Last-TRB TD Size clear masks only 4 of the 5 TDSZ field bits (15 instead of 31) β€” controller mispredicts remaining packets on large transfers

Summary

'clear TD SIZE to zero' masks ~TDSZ_SET(15) but the field is 5 bits (31): when npkt had bit 4 set the last TRB reports 16 packets remaining - missed service opportunities, babble/short-packet misbehavior, completion timeouts on real silicon (QEMU model ignores TD Size so cannot manifest in guest). Upstream fixed by FreeBSD 4e792e431a92 (EuroBSDcon, real hardware). One-constant fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5270 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1019 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5270

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace + upstream fix-commit cross-reference

Verified recommended fix

see finding markdown

Verdict

untested (Low; streams mode off-by-default / QEMU xhci ignores TD Size - manifests only on real silicon per upstream reports)