# DF-1075 PoC — Multicast filter buffer allocated before device descriptor is read

## Bug

`kue_attach()` (`sys/bus/u4b/net/if_kue.c:488-493`) allocates
`sc->sc_mcfilters = kmalloc(KUE_MCFILTCNT(sc) * ETHER_ADDR_LEN, ...)` BEFORE
the device descriptor is read. At this point `sc_desc` is zero-initialised,
so `KUE_MCFILTCNT(sc) == 0`, and `kmalloc(0)` returns `ZERO_LENGTH_PTR =
(void *)-8`. The NULL check at line 490 does not catch `(void *)-8`. Later,
`kue_attach_post()` reads the real descriptor (`if_kue.c:439-440`), but the
buffer is never reallocated. When `kue_setmulti()` memcpy's into
`KUE_MCFILT(sc, 0) = &sc->sc_mcfilters[0] = (char *)-8`, the kernel panics
with a page fault at the unmapped `ZERO_LENGTH_PTR` address.

## PoC approach

The actual `kue(4)` driver requires physical USB hardware (a KLSI
KL5KUSB101B USB-Ethernet adapter or a malicious USB gadget). This KVM guest
has no USB devices. The bug is therefore demonstrated by:

1. **Source-level trace** — every cited line confirmed in `sys/`.
2. **Kernel-module harness** (`df1075_harness.c`) that replicates the exact
   buggy `kmalloc(0)` + `memcpy` pattern and produces the predicted panic.

The real attacker-side PoC (for hardware-equipped targets):
- Malicious USB gadget presenting a supported `(VID, PID)` (e.g. `0x04cf:0x0001`),
  accepting `KUE_CMD_SEND_SCAN` firmware-download requests, and responding to
  `KUE_CMD_GET_ETHER_DESCRIPTOR` with `kue_mcastfilt >= 1`.
- Host brings up the interface (`ifconfig ue0 up`, often automatic).
- IPv6 adds multicast addresses → `SIOCADDMULTI` → `kue_setmulti()` → panic.

## Build (inside the guest, as root)

```sh
cd /root/poc_df1075 && make       # buggy-pattern harness
cd /root/poc_df1075_fixed && make # fixed-pattern harness
```

## Run

```sh
# On UNPATCHED kernel (#0): loads buggy harness → guest panics
kldload /root/poc_df1075/df1075_harness.ko

# On FIXED kernel (#1): loads fixed-pattern harness → no panic
kldload /root/poc_df1075_fixed/df1075_fixed.ko
dmesg | tail -6
```

## Expected output

**Buggy harness (unpatched `#0`):**
```
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0xfffffffffffffff8
fault code		= supervisor write data, page not present
Stopped at      df1075_modevent+0x91:   movl    $0x3333,(%rbx)
```
Guest is down (DDB prompt).

**Fixed-pattern harness (patched `#1`):**
```
DF-1075-FIXED: kmalloc(32*6=192) returned 0xfffff8004f22ccd0
DF-1075-FIXED: memcpy into &mcfilters[0]=0xfffff8004f22ccd0 SUCCEEDED, no panic
DF-1075-FIXED: wrote 33:33:ff:00:00:01
DF-1075-FIXED: kfree OK — fix verified, no panic
```
Guest stays up.

## Impact

Reliable kernel panic (DoS) from USB device plug-in + interface up. The write
target is the fixed `ZERO_LENGTH_PTR` sentinel (`(void *)-8`), which the
attacker cannot redirect, so there is no path to code execution. Medium
severity (physical access + automatic trigger). Affects both malicious and
legitimate `kue` NICs.