# DF-4977 — trigger sequence (hardware-gated; not executable on the audit guest)

No userland program can drive this path on a machine without a CardBus controller:
the entry points are card events (CSC interrupts → `card_attach_card`/`card_detach_card`
on the `cbb` driver) or privileged driver detach. The faithful reproduction is a
physical sequence:

## Preconditions

* Machine with a `cbb` CardBus bridge (TI/Ricoh/O2Micro PCI-PCI bridge, hdrtype 2),
  DragonFly kernel with `cardbus` (built into X86_64_GENERIC — confirmed via
  `kldstat -v` on the audit guest, see env.txt).
* A CardBus card whose driver fails `device_detach` while busy. Example with the
  compiled-in `if_re`/`fxp`/`dc` families:

```
# as root: bring the cardbus NIC up so its detach will refuse
ifconfig re0 up        # or: keep a bpf reader attached: tcpdump -i re0 >/dev/null &
# OR with a serial card (pccard/sio):
stty -f /dev/ttyd0.open       # keep dial-out open as any user of group dialer
```

## Fire

```
# physical: eject the card   -> cbb CSC interrupt -> CARD_DETACH_CARD(cardbus)
#                             -> cardbus_detach_card() -> device_detach()==EBUSY
#                             -> resources released + dinfo freed, child survives
# equivalent software path (root): acpiconf -s 1   (cardbus_suspend -> same function)
```

## Observe (kernel debugger or instrumented build)

```
kgdb> p *(struct cardbus_devinfo *)<child->ivars>   # freed memory read
```

* `pciconf -l` after the botched detach still lists the child (device_delete_child
  failed) — its ivars are freed.
* `kldload <any cardbus driver>` → `cardbus_driver_added()` → `pci_print_verbose(&dinfo->pci)`
  walks the freed devinfo (cardbus.c:281-287) — UAF read; `pci_cfg_restore` writes
  restored BAR values into `dinfo->pci.cfg` — UAF **write** of card-controlled
  config values into reclaimed heap.
* The still-live driver continues to touch its released resources → bus-space aliasing.

## Why not run

The audit QEMU guest has no `cbb` device (env.txt `pciconf -l`), and neither QEMU's
i440FX machine nor DF userland offers a way to synthesize a CardBus bridge, so the
sequence above cannot be executed there. Nothing was built or run; attempts = 0.