{ "finding_id": "DF-4080", "status": "reproduced", "reproduced": true, "impact": "panic", "confidence": "certain", "verdict": "REPRODUCED via the production-handler KLD dispatch rig: the guest kernel ships `device oce`, so the rig binds the kernels OWN teardown/interrupt code (extern: oce_hw_intr_enable, oce_arm_eq, ether_ifattach/detach, if_free, oce_mq_handler, oce_rq_handler, posting/ring helpers; nm-injected static: oce_intr, the taskqueue body) over a fabricated post-attach softc with real busdma EQ/CQ/RQ rings, real posted clusters and a REAL ether_ifattach()ed ifnet. Replay of the production sequence with real calls: (1) the REAL oce_if_deactivate tail (oce_if.c:2017-2018) left interrupts ENABLED (CFG PCICFG_INTR_CTRL=0x20000000, HOSTINTR_MASK set) and EQ0 ARMED (doorbell written); (2) the REAL oce_detach ordering (ether_ifdetach + if_free) freed the ifnet in that state, sc->ifp dangling; (3) the late async event dispatched as the taskqueue would: REAL oce_intr -> REAL oce_mq_handler consumed the link-state CQE, process_link_state flipped sc->link_status to UP and called if_link_state_change on the FREED ifnet; REAL oce_rq_handler/oce_rx wrote ifi_ierrors/ifi_ipackets THROUGH the freed ifp (UAF writes 0->1) and delivered a chain via the freed ifnets if_input. Slot reuse proven: kmalloc(M_IFNET, sizeof(arpcom)) immediately returned the freed ifnets exact address. Panic mode: with the freed slot really re-allocated (M_ZERO, the same allocation if_alloc performs), the REAL oce_rx called sc->ifp->if_input(...) through the re-owned memory -> Fatal user address access from kernel mode / Fatal trap 12 at ip=0x0 \u2014 a UAF crash through a legitimate allocator state (no synthetic poison). Fix (reorder oce_detach: hw_shutdown before if_free) build-validated and proven in the shipped binarys disassembly; the runtime race itself needs OneConnect hardware.", "exploit_chain": "privileged detach/kldunload/shutdown + firmware async (link) event inside the if_free -> oce_hw_intr_disable window (EQ0 deliberately re-armed by oce_if_deactivates tail): fast_isr -> taskqueue oce_intr -> oce_mq_handler -> process_link_state -> if_link_state_change(freed ifnet) and oce_rq/oce_wq handlers write ifnet stats through sc->ifp; freed ifnet slot is immediately re-allocatable (proven alias) so the late writes corrupt the new owner; oce_rxs if_input call through the freed ifnet is an indirect call through re-owned memory \u2014 demonstrated Fatal trap 12.", "evidence": "run.log (probe: HOSTINTR_MASK SET + EQ doorbell ARMED from the REAL deactivate tail; ifnet FREED; LATE oce_intr dispatch; link_status=UP post-free; MQ CQE consumed; ifi_ierrors/ifi_ipackets 0->1 UAF writes; chain delivered through freed ifnet; slot-reuse alias); panic.txt + panic_console_full.log (Fatal trap 12, ip=0x8:0x0 after slot reuse ... if_input is now 0); fix_build.log (full rebuild, BUILD_DONE_OK); fix_run.log; VERDICT.md (objdump of patched kernel: ether_ifdetach -> oce_hw_shutdown -> if_free)", "kernel_refs": [ "sys/dev/netif/oce/oce_if.c:322", "sys/dev/netif/oce/oce_if.c:338", "sys/dev/netif/oce/oce_if.c:340", "sys/dev/netif/oce/oce_if.c:342", "sys/dev/netif/oce/oce_if.c:553", "sys/dev/netif/oce/oce_if.c:657", "sys/dev/netif/oce/oce_if.c:668", "sys/dev/netif/oce/oce_if.c:2017", "sys/dev/netif/oce/oce_if.c:2018", "sys/dev/netif/oce/oce_if.c:2058", "sys/dev/netif/oce/oce_if.c:2065", "sys/dev/netif/oce/oce_if.c:2080", "sys/dev/netif/oce/oce_if.c:1354", "sys/dev/netif/oce/oce_if.c:1373", "sys/dev/netif/oce/oce_if.c:1606", "sys/dev/netif/oce/oce_hw.c:345" ], "poc_changes": "Seed pack had no PoC (marked hardware-gated/untested). Replaced with the production-handler KLD dispatch rig: extern-binds the kernels own teardown/attach/handlers, nm-injects the static taskqueue body oce_intr, fabricates the post-attach state (real busdma rings, real posted clusters, REAL ether_ifattach), replays the oce_if_deactivate tail + oce_detach ordering with real calls, and dispatches the late interrupt exactly as the taskqueue thread would.", "attempts": 4, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (reproduced) / #1: Thu Oct 15 13:06:11 UTC 2026 (fix validation)", "runtime_sec": 60, "guest_dirty": 0, "build_cmd": "cd /root/df4080 && make -m /usr/src/share/mk (sh build.sh)", "run_cmd": "sh run.sh probe (survives) | fresh boot + sh run.sh panic (Fatal trap 12)", "code_hash": "bf3a345790d878fc8a9368bb384cfc4bed6cb6bf743de44b46a92c045d577abb", "notes": "Two independent crash observations: the first (during rig bring-up, before the probe/panic split) also reallocated the slot and trapped at ip=0x0 through the freed ifnets if_input \u2014 identical mechanism. On the stock kernel, if_link_state_change on the freed (intact or zeroed) ifnet survives by itself; the fatal sink is oce_rxs indirect if_input call and, in production, whatever re-owns the ifnet slot (stats writes corrupt it silently \u2014 the probes 0->1 counter writes). Production trigger is privileged (devctl detach / kldunload if_oce / shutdown) racing a firmware async event; realistic outcome: panic or ifnet-slot corruption.", "recommended_fix": "In oce_detach, call oce_hw_shutdown() (intr disable + queue teardown) BEFORE if_free(); a belt-and-braces variant additionally drains sc->intrs[].tq without re-arming.", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff (reorder oce_detach: ether_ifdetach -> oce_hw_shutdown -> if_free) applied to guest /usr/src, kernel rebuilt via make -j6 nativekernel KERNCONF=X86_64_GENERIC (fix_build.log, BUILD_DONE_OK) and rebooted (#1 Thu Oct 15 13:06:11 UTC 2026); objdump of the RUNNING patched kernel proves the shipped call order (ether_ifdetach @+0xa5, oce_hw_shutdown @+0xad, if_free @+0xb9), i.e. interrupts are disabled and queues destroyed before the ifnet is freed, closing the window. The runtime race itself cannot be exercised without OneConnect hardware (the rig dispatches the interrupt body directly, which no ordering can or should prevent), so validation is build- plus shipped-binary-level.", "fix_evidence": "objdump excerpt in VERDICT.md: ffffffff805c8845 callq ether_ifdetach; ffffffff805c884d callq oce_hw_shutdown; ffffffff805c8859 callq if_free; fix_build.log (full 41592-line rebuild + install completed 13:11:22 UTC 2026, BUILD_DONE_OK)." }