# DF-2607 — PoC verdict

**File:** `sys/bus/u4b/usb_pf.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

usbpf_xfertap() runs under the USB bus lock, checks bus->ifp!=NULL then dereferences bus->ifp->if_bpf ~126 statements later. usbpf_clone_destroy() NULLs ubus->ifp and calls if_free() WITHOUT acquiring bus->bus_lock, so the ifp can be NULL-ed or freed in the window between the check and the use (NULL-deref / UAF on the freed ifnet).

### Cited lines

- `sys/bus/u4b/usb_pf.c:182-197`
- `sys/bus/u4b/usb_pf.c:362`
- `sys/bus/u4b/usb_pf.c:488`

## Why it does not reproduce on this guest

Requires a live USB bus generating transfers (root-driven clone/destroy racing USB xfers). The QEMU guest has xhci/ehci host controllers but NO USB devices, so no transfers flow; the race window never opens. Also the destroy path is root-only (SIOCIFDESTROY). Not exercisable by an unprivileged user on this guest.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

In usbpf_clone_destroy, take USB_BUS_LOCK(ubus) around the ifp=NULL + bpfdetach/if_detach/if_free teardown so it cannot race usbpf_xfertap.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)