# DF-4611 — nm_init() programs ring/coeff buffers from unvalidated card-provided buftop → wrapped (≈4G) bus_space offsets

File: `sys/dev/sound/pci/neomagic.c` — pass 2 (GLM 5.3), 2026-09-22.

## THE BUG

`nm_init()` (neomagic.c:541) derives every buffer offset from `sc->buftop`,
and lets the *card* override it with an arbitrary 32-bit value read out of
its buffer-memory signature block:

```c
562:	sc->buftop = (nm_rd(sc, 0xa0b, 2)? 6144 : 4096) * 1024;   /* ZX */
571:	ofs = sc->buftop - 0x0400;
572:	sc->buftop -= 0x1400;
576:	if ((nm_rdbuf(sc, ofs, 4) & NM_SIG_MASK) == NM_SIGNATURE) {
577:		i = nm_rdbuf(sc, ofs + 4, 4);
578:		if (i != 0 && i != 0xffffffff) {
581:			sc->buftop = i;             <-- unvalidated card value
582:		}
583:	}
585:	sc->cbuf  = sc->buftop - NM_MAX_COEFFICIENT;   /* -0x5000 */
586:	sc->rbuf  = sc->cbuf  - NM_BUFFSIZE;           /* -0x4000 */
587:	sc->pbuf  = sc->rbuf  - NM_BUFFSIZE;
588:	sc->acbuf = sc->pbuf  - (NM_TOTAL_COEFF_COUNT * 4);   /* -0xC560 */
```

A sane buftop is 4–6 MB, so nothing checks the arithmetic.  A defective or
hostile card returning a small `i` makes `cbuf/rbuf/pbuf/acbuf` **wrap to
~0xffffxxxx**: every later

* `nm_wrbuf(sc, sc->cbuf + i, coefficients[ofs+i], 1)` for i < 0x5000
  (nm_loadcoeff, neomagic.c:314 — runs at the first setformat/speed), and
* `sndbuf_setup(b, rman_get_virtual(sc->buf) + chnbuf, NM_BUFFSIZE)`
  (nmchan_init, neomagic.c:362 — makes every user write() memcpy ~4 GB
  past the BAR mapping)

…becomes a wild kernel-side write at a card-chosen offset below/around the
mapping.  Minimum legitimate buftop = 0x1400+0x5000+2×0x4000+0xC560 =
**0x1b960**; see `buftop_prover.c` output in run.log for the wrapped
offsets produced by hostile values (e.g. buftop=0x100 → pbuf=0xffff1d00).

## THREAT

Requires physical NeoMagic NM256 hardware whose buffer signature block
returns a crafted `i` (defective NVRAM, or a hostile PCIe device spoofing
the 10c8:8005/8006 IDs).  Attacker class = malicious/failed hardware, not
an unprivileged user; impact = kernel memory corruption at attach/first
use (steerable-offset wild write), realistically a panic.

## VERIFICATION STATUS: untested (hardware-gated)

No NM256 device model exists in QEMU 7.2 (env.txt), so the kernel-side
write cannot be triggered on the audit guest.  The arithmetic is proven by
the userland prover (`buftop_prover.c`, run.log) and the code path by the
citations above (confidence: certain for the defect; speculative for
real-world exploitation).

* fix build validation: `fix.diff` (range-check buftop ≥ 0x1b960 before
  use) applied to the guest's /usr/src and snd_neomagic.ko rebuilt with
  `-Werror` — clean (build.log).

## FIX

`fix.diff`: reject implausible buftop (< 0x1b960) with a diagnostic and
attach failure — same defensive posture DF-1371 established for
firmware-misreported geometry.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.