# VERDICT DF-4497 — sbsh stale xq/rq pointers after deactivate() (double-free / UAF)

## Bottom line

**INCONCLUSIVE at runtime (hardware-gated), defect CONFIRMED at source level.**
The QEMU audit guest has no Granch SBNI12/16 PCI modem (vendor 0x55, device
0x9d — see `env.txt`, `pciconf -l`), so the driver never attaches and the race
cannot be executed. The code defect itself is provable by inspection with no
assumptions beyond "the device raises two status bits in the same SR read or a
latched bit survives until a deferred ISR" — both are normal MMIO latching
semantics of this 2003-era driver's own register protocol.

## Source-level proof chain

1. `sbsh_intr()` latches `status = sc->regs->SR` once, then handles bits in a
   fixed order: **EXT first** (`if_sbsh.c:571-574`), then UFL (`:576-581`),
   RXS (`:583-587`), TXS (`:589-592`). SR bits are write-1-to-clear and are
   NOT cleared by `deactivate()` or `sbsh_stop()` — a TXS/RXS/UFL bit that
   latched before or during step 2 is still present in the local `status`
   variable / in SR for a deferred ISR.

2. EXT handling reaches `cx28975_interrupt()` (`:865-892`), which calls
   `deactivate()` on carrier loss while ACTIVE (`:878-881`).
   `deactivate()` (`:849-860`):
   - forces `CTDR = LTDR` and `CRDR = LRDR` (`:855-856`),
   - calls `drop_queues()` (`:859`) — `m_freem()` of every mbuf in
     `sc->rq[]`/`sc->xq[]` and resets head/tail indices (`:811-823`),
     **leaving the freed pointers in the arrays**, and
   - does *not* touch `head_tdesc`/`head_rdesc`, does *not* clear SR.

3. Because `CTDR`/`CRDR` were just forced to the posted ends, the subsequent
   TXS/UFL/RXS branches see `head_tdesc != CTDR` / `head_rdesc != CRDR`
   whenever frames were in flight:
   - `free_sent_buffers()` (`:726-748`) walks descriptors and executes
     `m_freem(sc->xq[sc->head_xq++])` (`:739`) on slots whose mbufs were
     freed a few instructions earlier → **double free**.
   - `indicate_frames()` (`:789-809`) takes `m = sc->rq[sc->head_rq++]`
     (`:796`), writes `m->m_pkthdr.len = m->m_len = <11-bit device value>`
     (`:799-800`) into freed memory, and passes the freed mbuf to
     `if_input()` (`:803`) → **UAF + second free** in the ether_input path.
   - `resume_tx()` (`:611-621`) additionally re-enables `TXEN` on the
     deactivated chip and its walk indexes `sc->tbd[cur_tbd]` with an
     unmasked device-supplied CTDR.

4. Deferred-ISR variant (no same-ISR coincidence needed): `sbsh_stop()` runs
   under `ifp->if_serializer` from SIOCSIFFLAGS down (`:491-496`); a TXS whose
   hardware interrupt was raised before the serializer was taken is delivered
   right after the ioctl releases it, with `state == DOWN` and the same stale
   arrays. Neither `free_sent_buffers()` nor `indicate_frames()` checks
   `sc->state` (contrast `sbsh_start()`, which does gate on ACTIVE,
   `:319-320`).

## Why not `reproduced`

No trigger can create `sbsh0` on this guest: probe requires PCI
0x55:0x9d:0x…:3 (`if_sbsh.c:206-215`), absent per `env.txt`. The BPF injector
compiled and ran; it fails at `BIOCSETIF: Device not configured` (`run.log`)
— the interface does not exist.

## Exploit chain (for the day suitable hardware/emulation exists)

Peer drops carrier while frames complete → double-free of an mbuf cluster →
classic mbuf/cluster freelist poisoning → overlapping allocation → forge
`m_ext` / refcount → arbitrary free → uid=0. This is a race with a
device-timing window, so reliability would be moderate; the RX variant writes
a device-controlled 11-bit value at two fixed offsets in freed memory, which
is the stronger grooming primitive.

## Fix

`fix.diff` — three layers: (1) `state == ACTIVE` guards in
`free_sent_buffers`/`indicate_frames`/`resume_tx`; (2) `deactivate()` drains
latched SR bits and re-syncs `head_tdesc`/`head_rdesc` to the forced cursors;
(3) `drop_queues()` NULLs the slots it frees. Authored after verification,
against the read-only `sys/` tree; not runtime-validated (baseline itself
cannot run on this guest).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.