# DF-1295 — cxm METEORSSIGNAL stores curproc without PHOLD → UAF

## Verdict
**NOT REPRODUCED** — real source-level bug confirmed; **unreachable on this
guest** (no Conexant video capture card; cxm module not loaded).

## Mechanism (verified)
- `cxm.c:2760` — `sc->enc_proc = sig ? curproc : NULL;` — stores raw `struct proc *` with no PHOLD.
- `cxm.c:1363-1364` — `if (sc->enc_proc) ksignal(sc->enc_proc, sc->enc_signal);` — async consumer from encoder-DMA interrupt.
- `kern_sig.c:1118-1120` — `ksignal` → `lwpsignal`.
- `kern_sig.c:1150` — `PHOLD(p);` inside `lwpsignal` ⇒ `atomic_add_int(&p->p_lock, 1)` ⇒ **write into the proc slab**.
- `cxm.c:2197` — `sc->enc_proc = NULL;` only in `cxm_close`.
- `cxm.h:235` — `struct proc *enc_proc;` raw pointer, no refcount.

Trigger (when HW present): child registers via `METEORSSIGNAL`, child exits,
parent keeps fd open ⇒ `cxm_close` not called for the child ⇒ `sc->enc_proc`
retains stale pointer ⇒ next DMA interrupt ⇒ `ksignal` on freed slab ⇒ UAF
write.

Confirmed real. The missing `PHOLD`/`PRELE` is the lifecycle defect.

## Why not triggered on this guest
- `pciconf -l` (env.txt): no Conexant capture device. Only virtio + Intel PIIX3/PIIX4.
- `kldstat -v | grep cxm`: empty — module not loaded.
- `cxm` is not in X86_64_GENERIC (it is a loadable module: `sys/dev/video/cxm/Makefile`).

Phase 4(d): genuinely not reachable on this kernel. With the card present the
trigger is plausibly unprivileged (`/dev/cxm0` default mode 0444 ⇒ read-only
open succeeds ⇒ `ioctl(METEORSSIGNAL)` permitted).

## Fix
`fix.diff`:
1. `cxm_ioctl(METEORSSIGNAL)`: `PRELE` the previous `enc_proc` if being replaced; `PHOLD(curproc)` when storing.
2. `cxm_close`: `PRELE(sc->enc_proc)` before clearing.

This pins the proc until the driver releases it, closing the UAF. Both
`PHOLD`/`PRELE` macros (`sys/sys/proc.h:482-483`) are already in scope via the
cxm.c includes.

## Fix validation
Compiles cleanly in the unified 5-fix kernel build (`fix_build.log`).
Runtime before/after is `not_testable` — no cxm device.

## Realistic impact
UAF write (atomic inc of `p_lock`) on a freed `struct proc` slab, gated on
cxm HW being present + a fork/exit dance. Likely panic on default GENERIC
(INVARIANTS); potentially groomable on a non-debug kernel.