{ "finding_id": "DF-4266", "status": "reproduced", "reproduced": true, "impact": "dos", "confidence": "certain", "verdict": "REPRODUCED at kernel level by dispatching the REAL production handler: the audit guests X86_64_GENERIC kernel has device wb built in, so the rig resolved the running kernels own static wb_rxeof()/wb_init()/wb_stop() from /boot/kernel/kernel (nm + sysctl injection; wb_newbuf exists only as an IPA-SRA clone and is never called directly - the ring is armed by the kernels own wb_init) and dispatched them against a fabricated post-attach softc with real rings, a fake miibus (zeroed mii_data: all mii calls degenerate safely), a real serializer, and an MMIO stand-in page; the NIC is simulated at the drivers only observation point - descriptor write-backs - bit-exact with the W89C840F protocol (wb_newbuf arms OWN=1; chip clears OWN + sets RXCMP|FIRSTFRAG|LASTFRAG|len on completion). Baseline (stock kernel #0): S1 - a chip-COMPLETED descriptor (OWN=0, len 64, marker frame in the armed buffer) made the real wb_rxeof break IMMEDIATELY at if_wb.c:974-975: delivered=0 ipackets=0 ierrors=0, descriptor never re-armed, head never advanced - permanent 100% RX loss, and since completed descriptors are never recycled the chip starves -> WB_ISR_RX_NOBUF -> wb_intr (if_wb.c:1137-1144) runs wb_reset+wb_init (full 64-mbuf ring teardown/re-init) for every arriving frame; untargeted L2 broadcast suffices: unauthenticated adjacent-network DoS. S1fix - the IDENTICAL state handed to a verbatim one-line-fixed comparator delivered the frame (if_input m_len=60, exact crafted payload, ipackets=1, slot re-armed) - only the inverted test blocks production. S2 - an armed idle ring (all OWN=1, exactly what wb_init leaves): every dispatch PROCESSED a chip-owned descriptor (head popped, ierrors++, receiver babbling: possible chip bug, forcing reset from the kernel, wb_fixmedia+wb_reset+wb_init full ring re-init per dispatch, ~65ms vs 9-13us on the fixed kernel). S3 - a mid-write-back-looking descriptor (OWN=1 + RXCMP|FIRSTFRAG|LASTFRAG|len): the real handler ACCEPTED the frame from a descriptor the chip still owns and RE-ARMED it under the chip (status rewritten to WB_RXSTAT) - ownership protocol broken end-to-end, the on-ramp to the DMA-race memory-safety tail tracked as DF-4268 (not re-verified here). Struct-layout agreement module-vs-kernel verified field-by-field against the kernels own disassembly (sizeof 0x1e80; if_timer 0x6a; wb_bhandle 0x3c0; wb_btag 0x3c8; wb_ldata 0x400; rx_chain[0] 0x448; wb_stat_timer 0x1e68; if_snd.altq_subq 0x210). FIX VALIDATED: fix.diff applied to the guests byte-identical /usr/src (MD5 bec15392abf0facf8fe77b4aefb23938), kernel rebuilt (make nativekernel) and rebooted, the IDENTICAL rig re-run against the real patched wb_rxeof: the completed frame is DELIVERED (ipackets=1, exact payload), armed-ring dispatches idle-break in 9-13us with zero side effects, the OWN=1 descriptor is untouched - every defective behavior gone, previously-impossible RX now works. Guest survived all runs.", "exploit_chain": "Any adjacent Ethernet frame (untargeted broadcast/multicast suffices, no authentication/privilege) -> chip completes descriptor (OWN cleared) -> wb_rxeof breaks at once -> frame dropped + descriptor never recycled -> ring exhaustion -> WB_ISR_RX_NOBUF/RX_OK interrupts -> wb_reset+wb_init full 64-mbuf ring teardown/re-init per interrupt (permanent reset storm, TX progress destroyed each cycle, 100% RX loss). If the interrupt races DMA write-back (OWN still set, RXCMP+len visible) the inverted loop accepts the in-flight descriptor, delivers a half-DMAd frame and re-arms the descriptor under the chip - driver/hardware ownership confusion (memory-safety tail: DF-4268). No uid0 route: availability-only on gated hardware.", "evidence": "kld_run_baseline.log (S1/S2/S3 BUG CONFIRMED markers + per-dispatch data: delivered=0 ipackets=0 descriptor untouched on completed frame; ierrors++/receiver babbling/mbuf0 replaced/full ring re-init per armed-ring dispatch at ~65ms; frame accepted from OWN=1 crafted 0xc0400300 and re-armed to 0x80000300); kld_run_fixed.log (same rig on the patched kernel: S1 delivered m_len=60 exact payload, S2 9-13us no-op, S3 status unchanged 0xc0400300); S1fix comparator A/B; env.txt (symbol addresses both kernels, MD5 source identity); VERDICT.md (method, layout cross-check vs kernel disassembly, A/B table); panic_rig_v1.txt (rig v1 NULL-altq_subqueue panic - rig bug, fixed); fix_build.log + fix.diff", "kernel_refs": [ "sys/dev/netif/wb/if_wb.c:972", "sys/dev/netif/wb/if_wb.c:975", "sys/dev/netif/wb/if_wb.c:982", "sys/dev/netif/wb/if_wb.c:988", "sys/dev/netif/wb/if_wb.c:993", "sys/dev/netif/wb/if_wb.c:1137", "sys/dev/netif/wb/if_wbreg.h:243" ], "poc_changes": "Prior pack revision had only a userspace logic harness (wb_logic.c) and verdict untested. This run added the production-handler KLD dispatch rig (df4266_wb_poc.c): nm-resolves the kernels own wb_rxeof/wb_init/wb_stop, fabricates the post-attach softc (static .bss wb_softc+wb_list_data, fake miibus device_t with zeroed mii_data, real lwkt serializer, per-cpu ifdata, real ifaltq_subque per if_attach net/if.c:592-640, MMIO stand-in page), arms the ring by dispatching the real wb_init, and crafts the three W89C840F descriptor states (completed write-back / armed / mid-write-back transient). Rig v1 panicked on a NULL if_snd.altq_subq inside the kernels wb_stop - fixed by replicating if_attachs subqueue setup; recorded in panic_rig_v1.txt. Authored clean git-apply-able fix.diff (prior one had prose before the header) and validated it with a full kernel rebuild A/B.", "attempts": 3, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline) / #1: Wed Oct 14 08:13:16 UTC 2026 (fix validation)", "runtime_sec": 1500, "guest_dirty": 0, "build_cmd": "sh /root/df4266/kld_build.sh (= cd /root/df4266 && make -m /usr/src/share/mk; clean -Werror)", "run_cmd": "sh /root/df4266/kld_run.sh baseline [fix A/B: apply fix.diff to /usr/src, make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel, reboot, sh /root/df4266/kld_run.sh fixed]", "code_hash": "2832d9dac9e28bccba795d56109353f4b23836de295b20db58a1005ac61c0b60", "notes": "Production-handler KLD dispatch evidence class (DF-4106 vge precedent). Hardware-gated aspects argued: the drivers decisions are a pure function of descriptor words + MMIO; both sides of the OWN protocol event were fed bit-exactly and the kernels own code was executed. Memory corruption itself is NOT demonstrated here (availability only); the S3 ownership-protocol break is the on-ramp to DF-4268 (chip-vs-driver descriptor/buffer race) which remains separately tracked. S2s ~65ms per-dispatch cost is dominated by the MMIO-stand-in reset poll (real HW clears WB_BUSCTL_RESET quickly); the ring teardown/re-init work (64 m_freem + 64 MGETHDR + descriptor re-init) is identical either way and is what production pays per interrupt. Compounds with DF-4267 (collapsed RX ring, wb_list_rx_init nexti typo) - rig inherits the production collapsed-ring state and notes it. Guest left up and clean (vm.sh reset with-src after the fix-validation reboot).", "recommended_fix": "Invert the OWN test in wb_rxeof: break while (rxstat & WB_RXSTAT_OWN), i.e. process only chip-released descriptors - restores the FreeBSD 4.11 loop direction (fix.diff, kernel-A/B validated).", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff applied to the guests /usr/src (byte-identical to the audit tree), kernel rebuilt via make -j6 nativekernel + installkernel, rebooted into kernel #1, and the IDENTICAL rig re-run against the real patched wb_rxeof: the chip-completed frame is now DELIVERED (if_input m_len=60 with the exact crafted payload, ipackets=1, descriptor re-armed) - previously impossible; armed-ring dispatches break immediately in 9-13us with ierrors=0 and no ring re-init (vs ~65ms babble+full reset per dispatch on baseline); the OWN=1 mid-write-back descriptor is left untouched (status unchanged, delivered=0). Every defective behavior gone; no regressions observed in the run.", "fix_evidence": "fix.diff; fix_build.log (if_wb.c recompiled, kernel install completed, INSTALL_DONE); kld_run_fixed.log / fix_run.log (S1 delivered by the REAL patched handler; S2 dispatches: ipackets=0 ierrors=0 ring re-inited:no elapsed 9-13us; S3: slot0.status unchanged 0xc0400300, delivered=0); fix_kernel_uname: DragonFly 6.5-DEVELOPMENT #1: Wed Oct 14 08:13:16 UTC 2026" }