{
  "finding_id": "DF-5334",
  "status": "reproduced",
  "verdict": "Deterministic kernel panic at USB device enumeration: cdce_attach() failure branches (if_cdce.c:610 no data interface found / :660 No valid alternate setting found) jump to cdce_detach() before the embedded usb_ether was initialised (ue_lock assigned only at :720, ue_tq/ifnet never created). uether_ifdetach() then lockmgr()s through the NULL ue_lock (fault VA 0x0) and would proceed to if_detach() on the zeroed embedded ifnet, NULLing ifindex2ifnet[0] (lo0) and corrupting the global ifnetlist via TAILQ_REMOVE - the NULL-guard it relies on is dead code on DragonFly because uether_getifp() returns the embedded arpcom ifnet which is never NULL. Reproduced 3/3 with the STOCK QEMU usb-net (RNDIS+CDC) device at boot and via hot-plug; backtrace captured through DDB over serial. Patched modules (fix.diff: early-out in uether_ifdetach when ue_lock==NULL + detach_usb label in cdce_attach) boot clean with the same device: ENXIO on the failing claim, driver then attaches the data interface and ue0 works; 0 Fatal traps.",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "run.log/run.serial.log (full serial: cdce0: No valid alternate setting found -> Fatal trap 12 fault VA 0x0 -> DDB trace lockmgr_exclusive <- uether_ifdetach+0x2f <- cdce_detach+0x2a <- cdce_attach+0x56b <- device_doattach <- usb_probe_and_attach <- uhub_explore, plus dumpsys); panic.txt (extract); run.2.log (patched boot: clean attach returned 6 then ue0: <USB Ethernet> on cdce0, No core dumps found); build.log (both fixed modules rebuilt -Werror clean, md5-matched into /boot/kernel); fix.diff (git-apply-able, module-only); env.txt (uname, cc 8.3, ue0 state, kldstat)",
  "kernel_refs": [
    "sys/bus/u4b/net/if_cdce.c:580",
    "sys/bus/u4b/net/if_cdce.c:593",
    "sys/bus/u4b/net/if_cdce.c:603-613",
    "sys/bus/u4b/net/if_cdce.c:642-664",
    "sys/bus/u4b/net/if_cdce.c:717-721",
    "sys/bus/u4b/net/if_cdce.c:730-732",
    "sys/bus/u4b/net/if_cdce.c:741-743",
    "sys/bus/u4b/net/usb_ethernet.c:133-137",
    "sys/bus/u4b/net/usb_ethernet.c:267-305",
    "sys/net/if.c:966",
    "sys/net/if.c:982"
  ],
  "poc_changes": "No compiled PoC was needed: the trigger is the stock QEMU usb-net device (12 Mbps, CDC/RNDIS dual config) attached to a UHCI controller; initial attempts on qemu-xhci also panicked (hot-plug). Added serial_drive.py to drive the DDB prompt over a unix-socket serial to capture the backtrace and call dumpsys.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64",
  "runtime_sec": 2400,
  "guest_dirty": 1,
  "build_cmd": "in-guest (fix validation): cd /usr/src/sys/bus/u4b/net/uether && make && cp uether.ko /boot/kernel/ && cd ../cdce && make && cp if_cdce.ko /boot/kernel/",
  "run_cmd": "cd dfbsd-qemu && QEMU_EXTRA=-device piix3-usb-uhci,id=uhci0 -netdev user,id=n1 -device usb-net,bus=uhci0.0,netdev=n1 ./vm.sh up 240   # unpatched: ssh timeout + Fatal trap 12 fault VA 0x0; patched: boots, ue0 works",
  "code_hash": "ac73ba61d1c3788f7d7d1f67ba2468622e3a88a6013618f1a066a1177a034bc8",
  "notes": "Threat model: attacker-supplied USB device (physical plug / evil NIC / VM attach). Both failure branches are device-controlled (union-descriptor slave number; alt-setting/STALL behaviour). Not escalatable: fault address is fixed VA 0 (lockmgr NULL), no attacker-controlled write; the latent if_detach second stage is pre-empted by the first fault. The usb_ethernet.c guard fixes the same latent pattern for every uether driver on DragonFly. Guest was left with fixed modules + patched /usr/src for the validation run; reset to with-src snapshot afterwards.",
  "recommended_fix": "uether_ifdetach(): return early when ue->ue_lock == NULL; cdce_attach(): route the two pre-attach failure branches to a detach_usb label doing only usbd_transfer_unsetup()+lockuninit() instead of full cdce_detach()",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied in-guest to /usr/src; if_cdce.ko and uether.ko rebuilt (-Werror clean) and installed into /boot/kernel; rebooted with the identical QEMU usb-net configuration that panicked 3/3 baseline boots: guest boots to ssh, dmesg shows cdce0: No valid alternate setting found + device_probe_and_attach: cdce0 attach returned 6 followed by successful attach of the data interface and a working ue0; dmesg|grep -c Fatal trap = 0. Baseline panic and patched-clean boot both on record in run.log / run.2.log.",
  "fix_evidence": "run.2.log (patched boot serial: clean ENXUI then ue0 up, No core dumps found); build.log (module rebuild + md5 match into /boot/kernel); fix.diff (unified, git-apply-able against clean sys/ tree)"
}