β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5388

No bus arbitration across transactions: serializer is dropped during RX waits, so concurrent smbus callers interleave inside one transfer

Summary

zsleep atomically releases sc->slz during RX waits and SMB_REQUEST_BUS is a stub returning 0: a second caller takes the serializer mid-A-transfer, resets rpos/rnext (discarding A's buffered data), possibly re-enables the controller, and A later consumes B's bytes as its own. Concurrent kernel users cross-deliver data (trackpad/sensor/SSIF). Real-REQUEST_BUS-exclusion fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5388 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.0 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5388

Confirmed kernel references

Detail

Evidence (decisive lines)

wire-level source proof vs SMBus 2.0 spec + ig4_reg.h documented abort/flush semantics

Verified recommended fix

see finding markdown

Verdict

untested (hardware-gated: no Intel LPSS I2C model in QEMU; pm SMBus is ichsmb, ACPI-injected fakes fail the COMP_VER gate)