# DF-1404 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (root/operator-only, module not loaded)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

cuse_server_open (:791): lockinit(&cuse_global_mtx,...) unconditionally zeroes lk_count/lk_lockholder. Global mtx already initialized at boot (:293). Concurrent holder (cuse_server_unref TAILQ_REMOVE :701) loses lock → two threads in global critical section → cuse_server_head TAILQ corruption → UAF/double-free. This is a copy-paste of boot init; should only init pcs->mtx (which :793 already does correctly).

**Source:** `sys/dev/misc/cuse/cuse.c:791`

## Why it cannot be reproduced on this guest

NOT reachable as maxx. cuse.ko is not loaded, no /dev/cuse exists. Even when loaded, /dev/cuse is 0600 root:operator (maxx not in operator).

## Phase 6: Escalation Assessment

This is a **Root/operator-only (cuse module not loaded)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Delete line 791 (the erroneous lockinit of cuse_global_mtx). Line 793 already correctly inits pcs->mtx.

**Fix description:** Delete the erroneous lockinit(&cuse_global_mtx,...) line in cuse_server_open (copy-paste of boot init).

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)