# DF-4599 verdict — REPRODUCED (panic / kernel-heap UAF read; root-gated)

## Root cause (code, certain)
* `vinumioctl()` dispatches `VINUM_RESETCONFIG` at `sys/dev/raid/vinum/vinumioctl.c:214-226`:
  it checks `vinum_inactive(0)` (which itself takes and *releases* `lock_config`, `vinum.c:179-187`)
  and then calls `free_vinum(1)` **without holding `lock_config`**.
* `free_vinum()` (`sys/dev/raid/vinum/vinum.c:199-259`) frees **all four** global object arrays —
  `Free(DRIVE)` :213, `Free(SD)` :228, `Free(PLEX)` :244, `Free(VOL)` :255 — `bzero(&vinum_conf, …)`
  and reallocates initial-size arrays via `vinum_initconf()` :258. It never takes the config lock.
* Meanwhile `VINUM_CREATE` (`vinumioctl.c:102-116`) *does* hold `lock_config()` while
  `parse_user_config` → `find_volume()`/`get_empty_vol()`/`EXPAND` walks and grows those same arrays
  (`EXPAND` → `expand_table()` `Free()`s the old array, `vinummemory.c:65-81`).
  Every unlocked reader (`VINUM_*CONFIG` bcopy handlers, `vinumioctl.c:118-178`) is equally exposed.

So the lock that `VINUM_CREATE` relies on is simply ignored by the biggest destructor in the driver.
Windows: (a) reader/writer walking an array freed by `free_vinum` (UAF read), (b) `free_vinum`'s
`Free(VOL)` racing `EXPAND`'s `Free(old)` on the same chunk (double free), (c) `parse_user_config`
writing into an array freed by `free_vinum` (UAF write).

## How it was reproduced (stock kernel, `kldload vinum`, root)
3 threads hammering `/dev/vinum/control`:
* creator: `VINUM_CREATE` ("volume vN", N monotonic → constant `EXPAND(VOL)` churn under the lock)
* resetter: `VINUM_RESETCONFIG` loop (`free_vinum` every iteration)
* reader: `VINUM_SDCONFIG` loop (unlocked bcopy)

Run 2 of 3 (240 s) killed the guest: serial console shows
`Fatal trap 12: page fault while in kernel mode … supervisor read data, page not present …
current process = 958 (resetconfig_race) … Stopped at strcmp+0xc` (see `panic.txt`).
`strcmp` on this path is `find_volume()`'s `strcmp(VOL[i].name, name)` walking the `VOL[]` array that
the racing `free_vinum` had just freed — a freed/unmapped kernel-heap page fault (UAF read) in the
process that *held* the config lock. Runs 1 (100 s) and 3 (240 s) survived: the race is probabilistic
(the decisive free/realloc window is narrow relative to the `destroy_dev` churn inside `free_vinum`).

## Impact
Root-gated (`/dev/vinum/control` 0600 + SYSCAP_RESTRICTEDROOT), so this is a post-root robustness /
kernel-integrity bug: demonstrated kernel heap UAF read (panic); the same interleaving gives UAF-write
(creator writing into freed arrays) and double-free windows. No unprivileged vector — the device cannot
be opened by non-root. Realistic severity: Medium (matches DF-1739/DF-4478 precedent).

## Fix validation (fix.diff)
`fix.diff` wraps `free_vinum(1)` in `lock_config()`/`unlock_config()` with a `setjmp(command_fail)`
(free_vinum → remove_drive → save_config can `throw_rude_remark` under the lock), and adds the missing
`break` that previously fell through into `VINUM_SETSTATE` (that fallthrough is DF-1741; leaving it
while holding no lock would trade one bug for another, so the break is required by this fix too).
Note `vinum_inactive(0)` must stay *outside* the lock (it takes the lock itself; nesting would deadlock).

* Patched build: `make nativekernel KERNCONF=X86_64_GENERIC` rc=0, `make installkernel` rc=0
  (kernel #1 Tue Sep 22 00:51:18 UTC 2026, `vinum.ko` rebuilt with the fix).
* Patched runs: 2 × 240 s at ≥ baseline load (1.51M+1.60M resetconfigs, 9.23M+3.61M sdconfigs,
  ~333K volume creations): guest survived both, no panic (`fix_runs.log`).
* Baseline vs patched: 1 kill / 3 runs → 0 kills / 2 runs at higher op counts. **Fixed.**

## Negative results worth recording
* `bus_dmamap_unload`/`bus_dmamem_free` NULL-guard their maps (`sys/sys/bus_dma.h:312`,
  `busdma_machdep.c:553`) — mpt's partial-init free path is safe.
* `expand_table` bzeroes new slots, so `VINUM_GETFREELIST` on a `drive_referenced` slot
  (`freelist_entries==0`) is bounded — no new OOB there beyond known DF-1740.
* `VINUM_SDCONFIG/PLEXCONFIG/VOLCONFIG/DRIVECONFIG` use unsigned compares on the index —
  negative indices are rejected (unlike the `valid*`/`resetstats` paths of DF-1739).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.