# DF-2679 — VERDICT

**status: reproduced** (baseline), **impact: dos** (kernel UAF read → panic / permanent hang),
**confidence: certain**.

## Root cause (path:line against the audited tree)

- `sys/kern/subr_bus.c:3879-3884` — `sysctl_devices()` walks the global
  `bus_data_devices` TAILQ (`TAILQ_FOREACH`) and then dereferences
  `dev->nameunit`, `dev->desc`, `dev->driver->name`, `dev->parent`,
  and dispatches `bus_child_pnpinfo_str`/`bus_child_location_str`
  (kobj dispatch reading `child->ivars`) with no lock held.
- `sys/kern/subr_bus.c:3871` — the only guard,
  `bus_data_generation_check(name[0])`, is checked *once* before the
  walk; `bus_data_generation` is a plain int incremented without
  atomics (`subr_bus.c:3922-3925`). It is advisory, not exclusion.
- `sys/kern/subr_bus.c:1302-1306` — `device_delete_child()` unpublishes
  the device with `TAILQ_REMOVE(&bus_data_devices, child, devlink)` and
  then frees it with `kobj_delete((kobj_t)child, M_BUS)` (kfree), with
  no synchronization against the readers above.
- `sys/kern/subr_bus.c:1164-1169` — `devclass_delete_device()` (called
  by both `device_delete_child` and `device_detach`) kfrees
  `dev->nameunit` before the device itself is freed — a second,
  earlier-freed pointer the readers copy out.
- `sys/kern/subr_bus.c:152-186` — `device_sysctl_handler()` has the
  same TOCTOU shape (`value = dev->desc ? dev->desc : ""` …
  `strlen(value)`), and its only protection (`oid_running` drain in
  `sysctl_ctx_free`, kern_sysctl.c) protects the *oid*, not the `dev`.

The sysctl node `hw.bus.devices` is CTLFLAG_RD and world-readable; the
walk is the documented userland ABI (`devinfo(8)`). The free side needs
a privileged topology mutation (kldload/kldunload, devd hotplug), which
is routine on hotplug buses.

## How it was reproduced

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, stock INVARIANTS
kernel), 6 vCPUs.

- `walker.c`: unprivileged loop — resolve `hw.bus.info` /
  `hw.bus.devices` MIBs via `sysctlnametomib(3)`, then fetch
  `hw.bus.devices.<gen>.<idx>` for idx = 0.. until error, forever
  (4 processes running as uid 1002 `testu`).
- `dfrace.c` (kld): MOD_LOAD adds 512 `dfrace` children to `root_bus`
  and registers a real driver on the root devclass so they probe,
  attach (`devadded` → devctl events) and later detach; MOD_UNLOAD
  deletes all 512 children (`device_delete_child` → kfree) and
  back-fills each freed `sizeof(struct bsd_device)` chunk with a
  0xAA-poisoned same-size `kmalloc` — modelling the kernel allocation
  that would recycle the chunk during the race window.
- Root churn loop: `while true; do kldload dfrace.ko; kldunload dfrace; done`.

### Baseline run 1 (panic — see panic.txt)

```
Fatal trap 9: general protection fault while in kernel mode
cpuid = 5; lapic id = 5
instruction pointer     = 0x8:0xffffffff8068c065
current process         = 42646
kernel: type 9 trap, code=0
Stopped at      sysctl_devices.part.15+0x35:    movq    0x18(%rbx),%rbx
```

`current process 42646` was verified beforehand to be one of the four
walkers (`ps -ax -o pid,uid,command` → `42646 1002 /tmp/df2679/walker`).
The faulting `movq 0x18(%rbx),%rbx` loads a field of the freed,
0xAA-filled `device_t` (non-canonical pointer → #GP).

### Baseline run 2 (hard wedge — see run.2.log)

Second fresh-boot run of the identical stress ended with the console
filling with `send_ipiq 5->0 tgt not draining (N)` — the walker thread
on CPU0 never returned from the walk (the poisoned `devlink` formed a
loop → unbounded in-kernel TAILQ walk) and the system became unusable;
ssh stopped answering and even `ps -ax` hung.

## Exploit chain (why impact is dos and not uid0_privesc)

The primitive is a UAF *read* of a freed `bsd_device` whose contents can
be groomed by racing kernel allocations. Chains toward escalation:

1. `strlcpy(udev.dv_name, dev->nameunit, 32)` /
   `strlcpy(udev.dv_desc, dev->desc, 32)` copy **up to 32 bytes** of
   whatever the freed chunk now contains out to the unprivileged reader
   (bounded kernel-heap disclosure), and
   `bus_child_pnpinfo_str(dev, udev.dv_pnpinfo, 128)` dispatches a kobj
   method on the *parent* with the freed device as `child`, whose
   `child->ivars` is read from freed memory — a fully groomable wild
   pointer deref inside driver pnpinfo formatters (128-byte copyout).
2. Getting from there to a controlled write requires winning the
   load-vs-free microsecond race with a kernel-side groom that places
   attacker-chosen bytes at the `nameunit`/`ivars` offsets of the
   recycled chunk; with only root-driven churn as the free side, the
   reliable outcome on this guest is the panic/hang demonstrated.

No uid=0 chain was developed; the honest ceiling shown is
unprivileged local DoS plus bounded heap-content disclosure.

## Fix validation

**fix_status: fix_failed (three iterations, all deadlocking against ACPI —
see fix_iterations.log / run.fixed.log).** The naive approach — a global
sleepable `bus_topo_lock` (shared in the readers, exclusive at
publish/unpublish/nameunit-free points) — was built and stress-tested
three times on in-guest `nativekernel` builds:

- v1 (kernel #1, 14:58:28): lock at make_device + all
  `devclass_delete_device` sites; SHARED across walk+dispatch+copyout →
  60 s ACPICA "indefinite wait" panic (`AcpiNsGetNode`).
- v2 (kernel #2, 15:16:12): publish unlocked, lock dropped before
  `SYSCTL_OUT` (strings snapshotted to locals) → same deadlock with the
  cycle pinned: walker holds topo SHARED inside `bus_child_pnpinfo_str`
  → `acpi_child_pnpinfo_str_method` → `AcpiGetObjectInfo` waiting on the
  ACPI namespace mutex, while an ACPI-side thread needs the topo lock.
- v3 (kernel #3, 15:30:16): probe-loop `device_set_devclass(0)` site
  unlocked, EXCL only at `device_delete_child`'s unpublish+free tail and
  `device_detach`'s `devclass_delete_device` → identical deadlock within
  ~4 minutes of identical stress.

Lesson (important for upstream): **any global lock held across the
`BUS_CHILD_PNPINFO_STR` / `BUS_CHILD_LOCATION_STR` kobj dispatches
inverts against ACPI-internal mutexes** reached from probe/attach
contexts. The correct fix needs per-device lifetime references:
refcount the `bsd_device` for sysctl/devctl readers (acquire before the
walk/dispatch, drop after), with `device_delete_child` unlinking first
and freeing only after the refcount drains. Short-term hardening can
snapshot `nameunit`/`desc` under a small lock while leaving the
dispatches unlocked-and-racy (narrows but does not close the hole).

The final `fix.diff` in this pack is v3 (the best-scoped variant); it
fixes the demonstrated UAF but introduces the ACPI deadlock under heavy
churn and must NOT be merged as-is.