# DF-2397 — Unsynchronized AGP memory-list operations (sys/dev/agp/agp.c)

## Verdict: NOT REPRODUCED (HW-gated); REAL BUG IN SOURCE (defense-in-depth fix warranted)

## Hardware gate (why the PoC cannot run on this guest)

The AGP ioctls (`AGP_ALLOC_MEMORY`, `AGP_FREE_MEMORY`, `AGP_BIND_MEMORY`,
`AGP_UNBIND_MEMORY`) are served through `/dev/agpgart`, which is created only
when an AGP bridge driver (`agp`) attaches. The audit QEMU/KVM guest has no AGP
bridge:

```
$ ls /dev/agpgart 2>&1          # No such file or directory
$ pciconf -l | grep -iE "agp|0x0302|bridge"   # only i440fx hostbridge + PIIX ISA bridge
hostb0@pci0:0:0:0:  class=0x060000 chip=0x12378086   # i440fx (no AGP)
isab1@pci0:0:1:0:   class=0x060100 ...
$ kldstat | grep -i agp          # (none)
```

With `/dev/agpgart` absent there is no file descriptor on which to issue the
AGP ioctls, so the unsynchronized alloc/free/find/bind/unbind paths cannot be
raced by any user on this guest. AGP is a dead-bus technology absent from this
QEMU machine model.

## Source trace — the bug is REAL (sys/dev/agp/agp.c)

`sc->as_lock` is acquired **only** inside `agp_generic_bind_memory` (`agp.c:511`)
and `agp_generic_unbind_memory` (`agp.c:611`). Every other mutation of the
`sc->as_memory` TAILQ and the `as_allocated` / `as_nextid` accounting is
performed **without** the lock:

- `agp_generic_alloc_memory` `agp.c:474` `sc->as_nextid++`, `agp.c:481`
  `TAILQ_INSERT_TAIL(&sc->as_memory, ...)`, `agp.c:482` `sc->as_allocated += size`
  — no lock.
- `agp_generic_free_memory` `agp.c:495` `sc->as_allocated -= ...`,
  `agp.c:496` `TAILQ_REMOVE(&sc->as_memory, ...)` — no lock.
- `agp_find_memory` `agp.c:676-688` `TAILQ_FOREACH(&sc->as_memory, ...)` — no
  lock; returns a raw `struct agp_memory *` to its caller.
- `agp_deallocate_user` `agp.c:733` calls `agp_find_memory` then frees — no lock.
- `agp_bind_user` `agp.c:748` calls `agp_find_memory` (no lock) and passes the
  pointer to `AGP_BIND_MEMORY` which only acquires the lock **inside** bind:
  a classic TOCTOU window between the unlocked find and the locked bind lets a
  concurrent free (also unlocked) free the object out from under the binder.
- `agp_close` `agp.c:800` iterates `TAILQ_FIRST(&sc->as_memory)` across
  `AGP_FREE_MEMORY` calls with no lock.

Two concurrent ioctl callers (root — `/dev/agpgart` is operator/root on
DragonFly) can therefore corrupt the TAILQ and free a `struct agp_memory` while
another thread still holds/dereferences it → UAF / kernel memory corruption or
panic. The lock comment in the source states it only prevents re-entry to
`bind_body`, confirming the gap is by omission, not design.

Impact: concurrency race → TAILQ corruption / UAF; requires root-or-operator
access to `/dev/agpgart` plus an AGP bridge. Real bug; privilege boundary is
root↔kernel (hardening gap), not unpriv→root.

## Exploit chain status

Not pursuable — primitive is behind absent AGP hardware and is root-only even
on hardware (valid Phase-6 hard blocker: write reachable only from an already-
privileged `/dev/agpgart` context). No unprivileged escalation.

## PoC changes

None. `/dev/agpgart` absent; verified by source trace only.

## Recommended fix

Take `sc->as_lock` around alloc/free/find/deallocate/close as well as bind.
See `fix.diff` (matches finding proposal: serialize all `as_memory` list +
accounting mutations under `as_lock`).