# DF-2315 — pnp_check_quirks PNP_QUIRK_EXTRA_IO writes ic_port[] past ISA_NPORT without a bounds check

**Verdict: REPRODUCED (mechanically, direct and end-to-end through the real parser).**
**Impact: struct isa_config field corruption (IRQ/DMA masks, all four resource counters) + unbounded ic_port[] index writes that escape the configs heap allocation at scale. Confidence: certain.**

## What was run

Same verbatim-interposition PNPH kernel harness as DF-2314 (pnp.c
TU-compiled unmodified, sha256-gated). Two drive modes:

- **direct**: the REAL `pnp_check_quirks()` (pnp.c:320, non-static) on a
  fabricated `struct isa_config` with `ic_port[0] = {0x220,0x22F,0x10,0x10}`,
  canaries in the masks/counters, and the SoundBlaster quirk identity
  (vendor 0xc1008c0e SB64 / logical 0x22008c0e — quirk table pnp.c:91-92,
  arg1=0x400, arg2=0x800).
- **end-to-end**: the REAL stock `pnp_parse_resources()` (pnpparse.c) on a
  crafted card stream of N IO_RANGE tags (tag 0x47, base 0x220) with the
  SB64 identity set on a real isa0 child — the parser calls
  `pnp_check_quirks(..., config)` after every IO_RANGE tag
  (pnpparse.c:169), each tag netting +3 ports (parser +1, quirk +2).

## Results (baseline, kernel #5 15:58:28)

**Layout proof** (runtime offsetof): `ic_port[50]` sits at +928 =
`ic_irqmask[0]` (its 16 bytes alias ic_irqmask[0..1] + ic_drqmask[0..1]);
`ic_port[51]` at +944 = `ic_nmem` (aliases ic_nmem/ic_nport/ic_nirq/ic_ndrq).
`ISA_NPORT` = 50 (isavar.h:63); struct is 960 bytes (isavar.h:86-95).

1. **ic_nport=49 (direct)**: arg1 → port[49] in bounds (nport 49→50);
   arg2 → **port[50] written** → ic_irqmask[0]=0xa20, ic_irqmask[1]=0xa2f,
   ic_drqmask[0]=0x10, ic_drqmask[1]=0x10 — the canaries
   {0xcafe0001..} are overwritten with port-derived values (port0+0x800
   start/end and its size/align). nport ends at 51.

2. **ic_nport=50 (direct)**: arg1 → **port[50]** → masks =
   {0x620,0x62f,0x10,0x10}; arg2 → **port[51]** → counters clobbered:
   ic_nmem=0xa20, **ic_nport=0xa2f (2607)**, ic_nirq=0x10, ic_ndrq=0x10.
   The config now claims 2607 IO ports in a 50-entry array — downstream
   isa resource allocation / pnp_set_config iterates `i < ic_nport` over
   `ic_port[i]` (pnp.c:274-278) → mass OOB reads and wrong card
   programming (IRQ/DMA/memory) — the wrong-IRQ/DMA/mem DoS the finding
   claims.

3. **Real path, 17 IO tags**: the stored config that escapes into the
   device (isa_config_entry via the real ISA_ADD_CONFIG, isa_common.c:939)
   shows nport=51 and irq={0xa20,0xa2f} drq={0x10,0x10} — the aliasing
   corruption demonstrably reaches the device record on the real
   parser path (the parser's own `== ISA_NPORT` check at pnpparse.c:137
   is equality-only and never fires on this +3/tag cadence).

4. **Real path, 18 IO tags**: the parser itself writes port[51] (its
   equality check misses 51) → ic_nmem=0x220, ic_nirq/ic_ndrq=0x10 in the
   stored config; subsequent quirk writes re-read the wild counter and
   land at offsets 960/976 — i.e. inside configs[1] of the 9×960-byte
   alternatives array.

5. **Real path, 200 IO tags**: stored config nport=0x258 (600); last
   quirk write at ic_port[599] = configs+9712, **past the end of the
   8640-byte kmalloc** — with card-controlled field bytes (ir_start =
   16-bit card-supplied base, ir_size/ir_align = card bytes). Silent on
   this guest (the 8640-byte request lands in a larger malloc size class
   that absorbs the slack), but it is a linear, attacker-paced heap
   overwrite with semi-controlled data once tags exceed ~178. No panic,
   guest stayed up through all runs.

## Reachability / attacker model (honest)

Same as DF-2314: parsed only at boot from ISA-PnP card resource data —
**malicious physical card or VM firmware** (AV:P). A genuine SoundBlaster
card never reaches 49+ ports legitimately; the overflow needs the
attacker-controlled stream. Low severity stands (hardware-attacker DoS /
config corruption, with a heap-overflow ceiling at scale).

## Fix validation

`fix.diff` bounds both EXTRA_IO increments:

    -                                if (qp->arg1 != 0) {
    +                                if (qp->arg1 != 0 && config->ic_nport < ISA_NPORT) {
    ...
    -                                if (qp->arg2 != 0) {
    +                                if (qp->arg2 != 0 && config->ic_nport < ISA_NPORT) {

Applied to the guest tree, kernel rebuilt and booted: direct runs leave
ALL canaries intact (nport 49→50 with arg1 legally applied; nport stays
50 at start 50 — both writes blocked); 17/18/200-tag real-path runs all
store a clean config (nport=50, masks/counters untouched). No regression
to the legitimate quirk behavior. fix_status: fixed.

## Reproduce

    # on the audit host (guest up):
    sh prep.sh && sh build.sh && reboot    # inside guest /root/pnp
    sh run.sh                              # baseline
    # apply fix.diff to guest /usr/src/sys/bus/isa/pnp.c, sh build.sh, reboot
    sh run.sh                              # A/B after fix

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.