{
  "finding_id": "DF-5314",
  "status": "reproduced",
  "verdict": "Unprivileged USB_FS_CLOSE x USB_FS_CLOSE on a shared ugen fd double-runs usbd_transfer_unsetup() on the same xfer (slot pointer read at usb_transfer.c:1379 before the locked NULL at :1405): panic Invalid setup reference count (USB_ASSERT at :1428) with two usbd_transfer_unsetup frames under ugen_ioctl -- reproduced 3/3 fresh boots, spin-gated PoC panics in round 1. On no-assert kernels the same race underflows endpoint->refcount_alloc to 0xFF (permanent endpoint lockout). The CLOSE x START face writes attacker-chosen nframes/frlengths/request bytes into freed-but-intact kernel memory (per-type kmalloc zones + 256-slot delayed-free ring shield it from crashing on the shipped kernel -- documented, not claimed). fix.diff validated: baseline panics gone, no functional regression.",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "unpriv maxx -> open /dev/usb/0.2.0 O_RDWR -> USB_FS_INIT + USB_FS_OPEN(ep0) -> 4 threads spin-gate-release USB_FS_CLOSE simultaneously -> two unservices both read pxfer[0] non-NULL -> double drain/deref -> second setup_refcount-- hits USB_ASSERT -> panic: Invalid setup reference count (guest dead in DDB). No uid0 chain on this kernel: the stale-write UAF face cannot be cross-type groomed (DFly kmalloc zones are per-malloc-type single-size) and freed blocks stay intact through the 256-slot delayed-free ring.",
  "evidence": "panic.txt (double usbd_transfer_unsetup stack + assert message), run.2.log (variant C: round 1 survived then guest death), run.patched.log (3000/3000 survived on fix-validated kernel), run.log (variant A negative + allocator analysis), fix.diff/fix_build.log (19 hunks, BUILD_RC=0, kernel #1 15:25:39)",
  "kernel_refs": [
    "sys/bus/u4b/usb_generic.c:1558-1568",
    "sys/bus/u4b/usb_generic.c:1051-1060",
    "sys/bus/u4b/usb_generic.c:1229-1238",
    "sys/bus/u4b/usb_generic.c:1590",
    "sys/bus/u4b/usb_transfer.c:1379-1405",
    "sys/bus/u4b/usb_transfer.c:1421",
    "sys/bus/u4b/usb_transfer.c:1428-1431",
    "sys/bus/u4b/usb_transfer.c:1333-1357",
    "sys/kern/kern_kmalloc.c:42-52"
  ],
  "poc_changes": "Variant A seeded from the DF-5288 rig conventions (same device/structs). Variant B added barrier sync (first version had a barrier-count bug: 3 threads on a 2-barrier -> self-deadlock, fixed). Variant C replaces the barrier with a spin gate so all closers enter ioctl within ~100ns -- lands deterministically (round 1) where the barrier versions us-scale skew missed in 5000 rounds.",
  "attempts": 9,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o df5314c df5314c.c -pthread -include stdlib.h",
  "run_cmd": "./df5314c   (unprivileged maxx, /dev/usb/0.2.0 chmod 0666)",
  "code_hash": "52cce9d4ba0cae2ad61d524c5866f497860c932546548b91390f1d082724e99b",
  "notes": "3 total baseline panics (2 exploratory + 1 documented). Variant A (CLOSE x START) survives 3072+ cycles on the shipped kernel for provable allocator reasons -- honest negative documented in VERDICT.md. usb_generic.fixed.c is the full patched reference file.",
  "recommended_fix": "Claim the fs_xfer slot under priv_lock in USB_FS_CLOSE (NULL it, then unsetup the claimed pointer) + priv_lock-held, poison-aware copy_in/copy_out + setup-claim in USB_FS_OPEN (see fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (19 hunks) applied to pristine /usr/src, make nativekernel BUILD_RC=0, installkernel INSTALL_RC=0, booted kernel #1 15:25:39: df5314c survived 3000/3000 spin-gated rounds (baseline panicked round 1, 3/3 boots); DF-5288 PoC regression survived; FS smoke 5/5 PASS; vmstat -m USB shows no orphan growth after the full suite.",
  "fix_evidence": "fix_build.log, run.patched.log, fix_validation section of VERDICT.md"
}