# DF-5167 — VERDICT

**Status: skipped / untested (static proof only). Reproduced: no (not reachable on the audit guest).**
**Classification if triggered: kernel use-after-free class teardown defect, boot-time availability/integrity.**

## Narrative

### The code path, proven line by line

1. `bt_pci_attach()` (`sys/dev/disk/buslogic/bt_pci.c:118`) allocates port + IRQ
   resources (`bt_pci_alloc_resources`, bt_pci.c:51-86; IRQ at bt_pci.c:76-77 with
   `RF_ACTIVE | RF_SHAREABLE`) and calls `bt_init_softc()` (bt_pci.c:83 → bt.c:163),
   which stores `bt->port`, `bt->irq` and `lockinit(&bt->lock)` (bt.c:175).
2. `bt_pci_attach()` then runs `bt_probe() || bt_fetch_adapter_info() || bt_init()`
   (bt_pci.c:147). `bt_init()` (bt.c:580-735) raises `bt->init_level` to 8,
   allocating the mailbox block, the CCB array, S/G maps and five child DMA tags.
3. `bt_attach()` (bt.c:737) then:
   - bt.c:770: `xpt_bus_register(bt->sim, 0)` — **the XPT now owns the bus**;
   - bt.c:776: `xpt_create_path(&bt->path, NULL, ..., CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD)`;
   - bt.c:789-794: `bus_setup_intr()` — **on failure: `device_printf` + `return (error)`
     with NO `xpt_bus_deregister()`, NO `xpt_free_path()`, NO `cam_sim_free()`**.
     (Contrast the two earlier failure branches at bt.c:770-774 and 776-783, which
     deregister and free the sim — the last branch simply forgot.)
4. `bt_pci_attach()` sees the error (bt_pci.c:152-156) and calls
   `bt_pci_release_resources()` (bt_pci.c:88-100):
   - releases the IOPORT rman record (bt_pci.c:95-96),
   - releases the IRQ rman record (bt_pci.c:97-98),
   - `bt_free_softc()` (bt.c:179-236): unload/free mailbox + CCB array + all S/G
     maps, destroy all child DMA tags, `lockuninit(&bt->lock)` (bt.c:236).

### Why the leftover state is dangerous

The registered SIM's `btaction`/`btpoll` closures capture `bt` (softc pointer,
bt.c:764-765 `cam_sim_alloc(btaction, btpoll, "bt", bt, ...)`). After step 4 the
CAM layer (probe periph reacting to the bus registration; any later XPT request
on the wildcard path `bt->path`) can still invoke `btaction()`, which:

- is entered under the sim lock `&bt->lock` (a destroyed lock object),
- reads card registers through the released port resource (on re-allocation of
  those ports to another driver this becomes cross-device register access),
- executes `btgetccb()` (bt.c:870) popping `bt->free_bt_ccbs` — a list embedded
  in `bus_dmamem_free()`'d memory (bt.c:192-232 case 6/8 of `bt_free_softc`),
  and writes CCB state there → **use-after-free read/write**.

The `init_level` ladder in `bt_free_softc` (bt.c:183-236) pairs every `init_level++`
in `bt_init` (bt.c:625,642,650,659,682,690,698,714 — max level 8; cases 9-11 for
sense buffers are dead code in this driver), so the DMA unwind itself is
complete **except** `parent_dmat` — that omission is the known DF-2162/DF-2431
pair and is intentionally not re-reported here. This finding is the *other*
half of the unwind that is broken: the CAM registration done by `bt_attach()`.

### Why it was not reproduced on the guest

- Requires a physical BusLogic MultiMaster PCI HBA (VID 0x104B, DID 0x1040/0x0140,
  bt_pci.c:47-48,105-107) present in the machine.
- Requires the host-side `bus_setup_intr()` to fail at boot — not attacker- or
  card-controllable.
- The QEMU audit guest has no such device; the failure point cannot be reached
  by any local program. Per the audit contract, Low/hardware-preconditioned
  findings skip the QEMU phase.

### Family calibration (same pass)

- dpt_pci DF-5153 (Low, CWE-459): identical shape, additionally left a shutdown
  handler and global softc list entry live.
- adv_pci DF-5043 (Low): the "IRQ resource left allocated" variant — **not**
  applicable to bt, whose glue does release the IRQ (bt_pci.c:97-98).
- adv_pci DF-5042 / dpt_pci DF-5154 = the `parent_dmat` leak family = bt's known
  DF-2162/DF-2431 (not re-reported).

## Bottom line

Certain-by-inspection boot-time teardown defect: the last error branch of
`bt_attach()` leaks the CAM registration, and the PCI glue's unconditional
resource release then pulls the port/IRQ records, the DMA memory and the softc
lock out from under the still-registered SIM — a UAF-class hazard bounded by the
rare trigger (vintage PCI HBA + IRQ-setup failure at boot), so Low severity,
no userland attack path, not testable on the audit guest.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.