# DF-4374 — ath sysctl read handlers race driver detach (UAF / unmapped MMIO read)

## What
The `dev.ath.N.*` sysctl read handlers in
`sys/dev/netif/ath/ath/if_ath_sysctl.c` are world-readable, and most of them
call into the HAL **outside** `ATH_LOCK` with no `sc_invalid` check and no
lifetime guarantee on `sc`/`sc_ah`:

- `ath_sysctl_txantenna` — power-set under lock (:256-258), HAL read at :260
  unlocked
- `ath_sysctl_diversity` — :316-318 lock, :320 unlocked HAL read
- `ath_sysctl_diag` — :347-349 lock, :351 unlocked `ath_hal_getdiag`
- `ath_sysctl_tpscale` :376-378/:380, `ath_sysctl_tpc` :403-405/:407,
  `ath_sysctl_rfkill` :430-432/:434, `ath_sysctl_rfsilent` :563-565/:567,
  `ath_sysctl_tpack` :602-604/:606, `ath_sysctl_tpcts` :627-629/:631,
  `ath_sysctl_intmit` :652-654/:656 — same pattern.

During driver detach, `ath_detach()` frees `sc->sc_ah` (`ath_hal_detach`,
if_ath.c:1436) and the PCI layer unmaps the register BARs, all *before*
`device_sysctl_fini()` (subr_bus.c:2151, called from `device_detach` only
after `DEVICE_DETACH` returns at :2141) removes the sysctl oids. The per-oid
`oid_lock` (kern_sysctl.c:1460-1482) protects the oid, **not** the softc:
a reader that entered a handler before detach began continues to run while
the hardware context is torn down → dereference of freed `ath_hal` state or
an MMIO read from unmapped space → kernel page fault / UAF read → panic.

The read side needs **no privilege** (`sysctl -n dev.ath.0.txantenna` as any
user); the detach side is privileged (`kldunload if_ath`, devctl-driven PCI
hot-remove, CardBus eject).

## Build / Run (probe)
- `./run.sh` — unprivileged probe: checks for `dev.ath.0.*`; if present,
  runs a reader storm intended to be raced against `kldunload if_ath` by
  root. On the audit QEMU guest there is no ath hardware, so it reports
  absence (see run.log).

## Expected on real hardware
With the reader storm running as an unprivileged user and root executing
`kldunload if_ath` (repeatedly), the kernel panics with a page fault in
`ar5212RegRead`/`OS_REG_READ` or a UAF read of `sc_ah` — timing-dependent,
typically within tens of detach attempts.

## Files
- `trigger_df4374.sh` — reader-storm probe
- `VERDICT.md` — lifetime analysis with citations
- `fix.diff` — hold ATH_LOCK across the HAL interaction and bail out when
  the device is invalid (representative for all affected handlers)