# VERDICT — DF-2938 **Status: reproduced** (stock INVARIANTS kernel, unprivileged trigger uid=65534). **Impact: kernel heap use-after-free** — demonstrated both as a fault-time indirect call through the freed `struct cdev` (with cross-object type confusion: the stale mapping was served a page belonging to the device that took over the chunk) and as a destructor-time read+write through the freed chunk producing `panic: assertion "dev->si_object" failed in old_dev_pager_dtor at device_pager.c:343`. Fix authored, built, and validated on the guest. ## Root cause (path:line) * `sys/vm/device_pager.c:124` — `cdev_pager_allocate()` runs the ctor and then stores `object->handle = handle` (:138) / `object->un_pager.devp.dev = handle` (:140) for OBJT_DEVICE objects **without `reference_dev()`**. * `sys/vm/device_pager.c:312-335` — `old_dev_pager_ctor` only validates the mapping range; it takes no cdev reference (the FreeBSD lineage of this function called `dev_ref(dev)`). * `sys/vm/device_pager.c:337-346` — `old_dev_pager_dtor` clears `dev->si_object` (read + write of the cdev) but never `release_dev()`s it. * `sys/vm/vm_mmap.c:1367-1374` — device mmap stores only the vm_object in the vm_map entry (`vm_map_find(map, object, NULL, ...)` :1478); nothing else pins the cdev for the lifetime of the mapping. * Freeing side (all examples drop the last *counted* cdev ref while a mapping survives): `destroy_dev()` from driver detach/kldunload; `snd_clone_gc` on last close of a 0666 `/dev/dsp*.*` clone (`sys/dev/sound/clone.c:431`, device made 0666 at `sys/dev/sound/pcm/dsp.c:2505-2508`, old pager allocated at `dsp.c:2357`); USB unplug of a 0666 uvc video node (`sys/bus/u4b/uvc/uvc_v4l2.c:763`, device made 0666 at :783-784). UAF sinks: `old_dev_pager_fault` :360 `dev_dmmap(dev, ...)` → `sys/kern/kern_device.c:276` `dev->si_ops->d_mmap(&ap)` (indirect call through freed memory); `old_dev_pager_dtor` :343-344 (KKASSERT read + NULL store into freed memory). ## How it was reproduced 1. `devuaf.ko` (evidence-pack module) creates `/dev/devuaf` 0666 with a classic `d_mmap` (no `d_mmap_single`), so `vm_mmap` takes the `dev_pager_alloc()` = old-pager path, exactly like syscons/agp/vga/ bktr/uvc/fwdev/nvmm/dsp. 2. `trig` (run as `nobody`, uid 65534) opens it, mmaps 2 pages MAP_SHARED, faults page 0 while the device is alive ('A' — normal old-pager fake-page insertion through the *live* cdev). 3. Root side performs the "driver teardown": `destroy_dev()` (`IOCTL_UAF_SWAP`), then immediately `make_dev()`s a replacement cdev pinned (via `usched_set`) to a chosen cpu so the freed chunk's fate is observable. 4. `trig` faults page 1: `vm_fault → dev_pager_getpage → old_dev_pager_fault → dev_dmmap(object->handle = the FREED cdev)`. Observed (stock kernel, serial console + `run.log`): * cpu-0 round: `TRIG: page1[0] = 'B'` and `STATUS old_chunk=0xfffff80116a0ef80 ... last_a_dev=0xfffff80116a0ef80` — the kernel handed the *destroyed* cdev pointer into `d_mmap`; the mapping of a destroyed device now aliases a page belonging to the replacement device generation (type confusion through freed memory). `munmap` silently wrote NULL into the freed chunk (dtor UAF write). * cpu-1 round: replacement `make_dev()` **re-used the freed chunk** (`SWAP old=0xfffff8004f2a7c80 new=0xfffff8004f2a7c80 reused=1`), and the unprivileged `munmap` panicked exactly as predicted: `panic: assertion "dev->si_object" failed in old_dev_pager_dtor at /usr/src/sys/vm/device_pager.c:343` with backtrace `old_dev_pager_dtor ← dev_pager_dealloc ← vm_object_terminate ← vm_object_deallocate ← vm_map_entry_dispose` (`panic.txt`). ## Exploit chain / primitive characterization Primitive: (a) attacker-timed **indirect call** — `dev->si_ops->d_mmap(&ap)` where `dev` is a freed `struct cdev` (~0x120 bytes, `devfs_dev_cache` objcache backed by `kmalloc(M_DEVFS)`) — the call happens on any later fault of the stale mapping, arbitrarily long after the teardown; and (b) an **unconditional NULL write** at `offsetof(struct cdev, si_object)` plus a NULL check (KKASSERT on INVARIANTS builds) at munmap time. Full uid0 chain on this guest (no KASLR/SMAP/SMEP): reclaim the freed chunk with attacker-controlled bytes, point the stale `si_ops` at a user-mapped fake `dev_ops`, and let the fault-time `d_mmap` call land in ring-0 shellcode. On the stock guest the chunk demonstrably round-trips through the per-cpu objcache magazine and was reclaimed by the next `make_dev()` (`reused=1` above); converting that into *content* control requires draining the objcache into the general kmalloc zone (memory-pressure cycle) and spraying same-size user-bytes allocations (e.g. SysV msg segments) — feasible but not completed within this run's time budget. Demonstrated end-to-end: freed-chunk indirect call + type confusion + deterministic INVARIANTS panic from an unprivileged process. A driver with a `d_mmap` whose ops table lives in *unloadable module memory* additionally turns the stale-ops read into a jump through freed/reused module memory on any kernel build. Real-world unprivileged vectors (no PoC module needed): `/dev/dsp*.*` 0666 clones (old pager via `dsp_mmap_single` → `dev_pager_alloc`, destroyed by the clone GC when the last fd closes — the unprivileged user controls *both* sides) and uvc `/dev/video*` 0666 on unplug; any other old-pager device via privileged teardown (kldunload) with the fault/munmap side unprivileged. ## Fix validation `fix.diff` restores the missing refcount pair: `reference_dev(dev)` when `cdev_pager_allocate()` creates the OBJT_DEVICE object for the old ops (device_pager.c:146-156) and `release_dev(dev)` in `old_dev_pager_dtor` (:351-359). Applied to the guest's `/usr/src`, `make -j6 nativekernel` + `installkernel` (kernel #1, Thu Sep 3 18:35:46 UTC 2026), rebooted, exact same PoC re-run on all six cpus: * baseline (stock #0): chunk re-use observed, unprivileged munmap → panic at device_pager.c:343. * patched (#1): 6/6 rounds `reused=0` (the destroyed cdev cannot be freed — it is pinned), all munmaps clean, guest stays up (`fixed.0.log` … `fixed.5.log`). The post-teardown fault is now served through the still-valid, pinned cdev — no freed-memory access at all. fix_status: **fixed**. ## Notes * The PoC's first iteration used `lwkt_migratecpu()` inside the ioctl which itself panicked the dfly scheduler (usched_dfly.c:453) — a PoC technique bug, replaced with `usched_set(USCHED_SET_CPU)`; not related to the finding. * The file-level companion race DF-2939 (dtor runs before the object is unlisted → `si_object` clobber → the same :343 KKASSERT) is a separate root cause; the F1 fix does not address it.