{
  "finding_id": "DF-5316",
  "status": "reproduced",
  "verdict": "USB_SET_CONFIG and USB_SET_ALTINTERFACE in ugen_ioctl_post perform privileged device reconfiguration (driver detach/re-attach, re-enumeration via usbd_start_set_config / usbd_set_alt_interface_index + usb_probe_and_attach) with no caps_priv_check, while the same file gates the equivalent raw control requests (ugen_check_request, usb_generic.c:874-887) and USB_DEVICEENUMERATE (:952) behind SYSCAP_NODRIVER. Reproduced as unprivileged uid 1001: raw SET_CONFIGURATION -> EPERM, but USB_SET_CONFIG(255) -> 0 and USB_GET_CONFIG then reports 255 (device genuinely unconfigured by maxx), restored with USB_SET_CONFIG(0) -> 0.",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "exploit_chain": "unpriv maxx (libusb-access perms on /dev/usb/0.2.0) -> open O_RDWR -> ioctl(USB_SET_CONFIG, 255) -> usbd_start_set_config schedules RE_ENUM_SET_CONFIG -> explore thread unconfigures the device, detaching interface drivers -> other consumers of the device lose it mid-operation (DoS / driver rebind confusion) -> ioctl(USB_SET_CONFIG, 0) reconfigures it back. Privilege-policy bypass of the SYSCAP_NODRIVER gate, not memory corruption.",
  "evidence": "run.log (baseline: [1] EPERM vs [2] success + curr_config_index=255 + [4] restore), run.patched.log ([2]/[3] both EPERM, config unchanged)",
  "kernel_refs": [
    "sys/bus/u4b/usb_generic.c:874-887",
    "sys/bus/u4b/usb_generic.c:952",
    "sys/bus/u4b/usb_generic.c:605-625",
    "sys/bus/u4b/usb_generic.c:628-652",
    "sys/bus/u4b/usb_generic.c:2096-2102",
    "sys/bus/u4b/usb_generic.c:2114-2121"
  ],
  "poc_changes": "Straightforward; [3] USB_SET_ALTINTERFACE demo ran while the device was unconfigured (EIO) -- ordered after the unconfig step; on a configured device it returns 0 unprivileged (same missing gate); patched run shows it gated.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o df5316 df5316.c",
  "run_cmd": "./df5316   (unprivileged maxx, /dev/usb/0.2.0 chmod 0666)",
  "code_hash": "33c5f64285733a85435fecc9b9cc3b6d95a10cbc99b58639a5a03e2d4c8b48d8",
  "notes": "Upstream FreeBSD parity (the check is missing there too, devfs perms being the nominal gate); on this audits standard libusb-access rig (and any 0666/0660-operator deployment) it is directly reachable unprivileged. Fix validated on the same patched-kernel build as DF-5314/5315.",
  "recommended_fix": "Add caps_priv_check_self(SYSCAP_NODRIVER) to ugen_set_config() and ugen_set_interface(), mirroring ugen_re_enumerate() (fix.diff in this pack)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (2 hunks) applied with the DF-5314 fix.diff in the same validation build (kernel #1 15:25:39): USB_SET_CONFIG(255) and USB_SET_ALTINTERFACE now return EPERM for uid 1001 and curr_config_index stays 0; raw-request behaviour unchanged.",
  "fix_evidence": "run.patched.log, ../DF-5314/fix_build.log"
}