# PoC DF-1502: musycc_intr0_tx_eom derefs sch after racy NULL/!UP early-out

**Class:** race-condition NULL/UAF deref (DoS)
**Cited site:** `sys/dev/misc/musycc/musycc.c:649-657`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — musycc(4) is in LINT64 only (not GENERIC); requires a LANai/CPCI mux card. Not present in audit guest. The driver is also entirely LOCKLESS (bus_setup_intr flags=0).

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/misc/musycc/musycc.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 649-653: `sch = sc->chan[ch]; if (sch == NULL || sch->state != UP) { kprintf(...); }` — note the early-out only PRINTS, it does not return. Line 657 then derefs `sch->tx_last_md` even if sch is NULL or not UP. Concurrent musycc_disconnect (1347-1350) kfree(sc->mdt[ch]) and NULLs the channel after SRD+tsleep; with no locks, an in-flight EOM interrupt can race past the disconnect and deref freed/NULL sch. NULL or freed deref → panic.

## Realistic impact ceiling

panic/UAF (DoS)

## Fix

Make the early-out actually return (`return;` after the kprintf) so a NULL/!UP channel is never dereferenced.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1502.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1502.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/misc/musycc && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```