Bug 08 - LcStProd Appears in Two unique case Branches (Debug/DFT Ambiguity in Production)

Legacy reference: Bug #7 in the working set (HW-001)

---

Security feature bypassed

Lifecycle Controller signal decode - debug/DFT enable semantics for the production lifecycle state

Attack type

Type 2 - physical attacker with hardware debug probe

Finding

LcStProd appears in two different branches of the unique case statement in lc_ctrl_signal_decode.sv:

1. Lines 109-124 (test-unlocked branch): LcStProd is grouped with LcStTestUnlocked0-6, enabling:
   • lc_dft_en = On
   • lc_nvm_debug_en = On
   • lc_hw_debug_en = On
   • lc_keymgr_div_d = RndCnstLcKeymgrDivTestUnlocked (weaker constants)
2. Lines 138-154 (production branch): LcStProd is grouped with LcStProdEnd, enabling:
   • lc_keymgr_en = On
   • lc_keymgr_div_d = RndCnstLcKeymgrDivProduction

SystemVerilog unique case requires exactly one matching case item; with two matches the behavior is undefined - synthesis/simulation may select either branch, and one of them enables debug and DFT in production.

Location or code reference

• hw/ip/lc_ctrl/rtl/lc_ctrl_signal_decode.sv:93 - unique case (lc_state_i)
• hw/ip/lc_ctrl/rtl/lc_ctrl_signal_decode.sv:116 - LcStProd in the test-unlocked branch (enables debug/DFT)
• hw/ip/lc_ctrl/rtl/lc_ctrl_signal_decode.sv:139 - LcStProd again in the production branch

New Tools

No automated detection tool. Manual RTL inspection + DeepWiki AI analysis of the decode enumeration.

AI Tools

Yes - DeepWiki AI-assisted analysis used as a cross-check during manual inspection.

LLM

Yes - DeepWiki (LLM-based repository analysis), used as a detection aid.

LLM Details

PLACEHOLDER - to be completed (model name/version, parameters, download link or API endpoint).

Online LLM Details

PLACEHOLDER - to be completed (input/output/total token counts, verification script).

LLM Prompts

PLACEHOLDER - to be completed (complete prompt, full model response, step-by-step explanation).

Detection method

Manual RTL inspection of the unique case enumeration for duplicated case items (LcStProd appears twice), cross-checked with DeepWiki. The unique case construct makes the ambiguity a lint/synthesis violation by construction; the finding is the security-relevant case-item collision.

Security impact

If synthesis resolves LcStProd to the test-unlocked branch (line 116), production chips ship with hardware debug and DFT enabled plus weaker key-manager diversification constants - exposing protected memories and cryptographic material. If it resolves to the production branch, key derivation uses weaker test constants, weakening cryptographic isolation. Relying on tool-specific unique case resolution for security-critical decoding is dangerous.

Adversary profile

Type 2 - physical attacker attaching a JTAG/hardware debug probe to a production device, or an authorized-debug entity (Type 4) exploiting the ambiguous decode.

Proposed mitigation

Remove LcStProd from the test-unlocked case item (line 116); keep it only in the production branch (line 139).

CVSSv3.1 score and severity

7.5 - HIGH

CVSSv3.1 Details

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

• AV: Physical - debug probe on the device
• AC: Low - ambiguity resolves to debug-enabled decode
• PR: None
• S: Changed - crosses from LC domain into debug/DFT
• C/I: High - memory/crypto exposure and modification

Attachment links

Located in this repository (GitHub is the cloud storage for the submission):

• exploit/
• exploit/code/
• exploit/logs/
• testbench/
• testbench/code/
• testbench/logs/