β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5386

TX-abort condition is read and discarded β€” writes to a non-ACKing slave return SMB_ENOERR success (silent write failure)

Summary

On NACK the DW controller flushes+holds the TX FIFO so TX_NOTFULL stays asserted: every write-path wait passes instantly, bytes are silently flushed, and the done: block reads TX_ABRT_SOURCE into a dead variable - writes to absent slaves return success while reads correctly fail. Configuration/command writes believed delivered when nothing touched the wire. Read-and-surface-the-abort fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5386 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5386

Confirmed kernel references

Detail

Evidence (decisive lines)

wire-level source proof vs SMBus 2.0 spec + ig4_reg.h documented abort/flush semantics

Verified recommended fix

see finding markdown

Verdict

untested (hardware-gated: no Intel LPSS I2C model in QEMU; pm SMBus is ichsmb, ACPI-injected fakes fail the COMP_VER gate)