# DF-4846 — VERDICT

**status: reproduced** (feeder level, real unmodified code on the audit guest)
**primitive:** up to oalign−1 (≤ 14) byte OOB write past the destination
window + window-preceding underwrite (ialign>oalign misround) + return value
past the caller's count into `sndbuf_acquire` (ring overflow)
**confidence: certain** (arithmetic defect exhaustively enumerated; feeder
behavior proven on the pristine file with the exact kernel-generated table)

## Root cause

`sys/tools/sound/snd_fxdiv_gen.awk:56-71` (calcdiv) validates its magic
reciprocal only at a single point (`(y*d) >> z >= 1`), not across the claimed
domain `x = 1..65536`. For every non-power-of-2 divisor the emitted
`SND_FXDIV(x,d)` equals `floor(x/d) + 1` for a large, exhaustively-enumerated
fraction of the domain — e.g. `FXROUND(5473,14)=5474`, `FXROUND(8207,24)=8208`
(hand-verified: `(5473*2341)>>15 = 391`, true `floor = 390`), first bad x per
align: 12→8195, 14→5473, 15→4694, 24→8207, 28→5487; worst overshoot at the
65536 top: 12→+8, 14→+12, 15→+14. This extends DF-4710 (feeder_eq, which
characterized only the 65536 boundary) to the whole upper half of the domain
— ordinary 8K–64K buffer counts, not exotic full-drain events.

`feeder_format.c` consumes the broken macros on the caller's byte window:

- `:220` `count = SND_FXROUND(count, info->oalign)` — misround ⇒ count' > count.
  The pass (source ask, in-place conversion tail, `dst` advance, and the
  returned `dst - b`) is then sized for count' — past the window the caller
  (sndbuf_feed, buffer.c:708-712) provided.
- `:233` `j = SND_FXROUND(count, ialign)` (ialign>oalign, e.g. S32→S16
  multichannel) — misround ⇒ j > count ⇒ `src = dst + count - j < dst`: the
  source feeder is asked to fill a window that starts BEFORE the destination
  buffer.
- `:240` `j = SND_FXDIV(FEEDER_FEED(...), ialign)` — miscount of a partial
  (user-paced) source return ⇒ frame overcount: the converter reads a frame
  past the delivered data and returns more bytes than the input warrants
  (over-report into sndbuf_acquire).

## Reproduction (guest, pristine file)

`fxfmt` (see `fmt.log`): `checks=28200 failures=8315`, decisive lines:

```
FAIL[T1 oalign>ialign] ch=5 in=00500010 out=00501000 count=16399 ret=16400 REAR guard (write past window) maxwrite_off=16400 maxask=8200
FAIL[T3 ret-misround over-conversion] ch=7 in=00701000 out=00700010 count=65520 ret=65506 return > delivered*(oalign/ialign) ...
```

The canary-guarded window is exactly `count` bytes (front 0xCB / rear 0xCA
guards, checked after every feed); "REAR guard" = the feeder wrote past the
window; `ret > count` = the return over-reports into sndbuf_acquire.

## Kernel reachability (each step verified in-tree)

1. Format feeder inserted on any encoding mismatch — `feeder_chain.c:139-173`
   (feeder_build_format), default chain mode, no root gate; the format choice
   is an unprivileged `SNDCTL_DSP_SETFMT`/`SNDCTL_DSP_CHANNELS` on `/dev/dsp`.
2. Head feeder invoked with `count = min(free, maxfeed)` where
   `maxfeed = SND_FXROUND(SND_FXDIV_MAX, align)` (buffer.c:705) — free is
   arbitrary user-paced, bad residues ≥ first_bad occur on every 8K–64K
   buffer with ~15–40% probability per feed.
3. Non-pow2 aligns are ordinary multichannel formats: 5ch/6ch/7ch S16/S24/S32
   (align 10/12/14/15/20/21/24/28).
4. Overshoot lands past `to->tmpbuf` (heap OOB when the allocation is exact,
   buffer.c:226 `kmalloc(round_page(bufsize))` at 64K geometry) and/or
   inflates the ring (`sndbuf_acquire`, buffer.c:615-636, KASSERT-only in
   production; `sndbuf_getfree = bufsize - rl` wraps unsigned).

## In-kernel attempt (honest)

ES1370 + two vchan children (6ch, 7ch S16) + bad-residue-paced writes: no
differential anomaly vs the aligned control (production kernel, no
INVARIANTS; the write is ≤ 14 bytes past a kmalloc and the ring overflow is
silent) — identical outcome to DF-4710's in-kernel attempt, and expected for
the same reasons. Logs in the DF-4849 pack.

## Fix validation

`fix.diff` (generator): domain-exact reciprocals + 64-bit multiply.
Exhaustive host check: all 44 table divisors exact over [1,65536].
Guest A/B: baseline `fxfmt` 8315 failures vs `fxfmt_fixed` **0 failures
(ALL PASS)** (`fmt.log` vs `fmt_fixed.log`). fix_status: fixed.

## Not re-reported

DF-4710 (feeder_eq, root-gated EQ) is the same idiom family in a different
file; DF-4601/4602 (feeder_chain) unrelated. This finding covers
feeder_format.c only.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.