# DF-1231 — README

## Finding

`aac_getnext_aif()` at `sys/dev/raid/aac/aac.c:3527-3546` walks
`sc->fibctx` and `tsleep()`s WITHOUT `aac_aifq_lock`. Concurrent
`aac_close_aif()` (`aac.c:3489-3512`) takes the lock, unlinks, and
`kfree()`s the same context → two UAF races:

- **traversal race** — close runs between two iterations of getnext's
  lookup loop; getnext then reads `ctx->next` of freed memory.
- **sleep race** — getnext `tsleep()`s without the lock; close frees
  `ctx`; on wakeup, getnext calls `aac_return_aif()` which derefs
  `ctx->ctx_idx`/`ctx->ctx_wrap` (`aac.c:3562, 3574-3575`) on freed
  memory.

## Verdict

**NOT REPRODUCED** on this guest (latent): the audit guest has no
Adaptec FSA RAID controller in `pciconf -lv`, so no `/dev/aacN` exists
and the ioctls are not reachable. The driver **is** statically linked
into `X86_64_GENERIC` (`kldstat -v` shows `pci/aac`), so the bug path is
in the running kernel and fires on real DragonFly installs with an
`aac(4)` adapter.

**Confidence (bug is real):** certain — traced line-by-line in `sys/`.
**Impact ceiling:** UAF → kernel heap corruption / DoS / potential
control-flow hijack. Reachable by any local user in `operator` group
once an `aac` controller is present.

## How to reproduce

```
./build.sh && ./run.sh
```

Expected on this guest: PoC builds clean, prints "No /dev/aacN found: No
such file or directory" and reachability analysis. On a host with an
`aac` controller, two processes racing
`FSACTL_GET_NEXT_ADAPTER_FIB (Wait=1)` vs
`FSACTL_CLOSE_FIB_ADAPTER` on the same fib context trigger the UAF.

## Files

| Path                        | Purpose                                                   |
|-----------------------------|-----------------------------------------------------------|
| `aac_getnext_aif_race.c`    | PoC: pthread-race demonstrator (operator-group reachable)  |
| `build.sh` / `run.sh`       | exact build/run commands                                  |
| `fix.diff`                  | take aac_aifq_lock across traversal; switch tsleep->lksleep |
| `VERDICT.md`                | full path:line trace, threat model, fix rationale         |
| `build.log` / `run.log`     | PoC build + run outputs                                   |
| `fix_build.log`             | kernel-build compile validation of fix.diff               |
| `env.txt`                   | guest uname / cc / device topology                        |