# DF-5352 VERDICT — reproduced (kernel panic from driver-facing legacy-config ABI), Low severity

## Bottom line

REPRODUCED on the guest both ways:

- production-behaviour kernel (X86_64_GENERIC minus `options INVARIANTS`;
  stock GENERIC ships without INVARIANTS): a KLD calling
  `MachIntrABI.legacy_intr_config(irq=24, LEVEL, LOW)` where irq 24 is an
  MSI-X map (im_gsi == -1) panics the kernel:
  `panic: ioapic_gsi_search: no I/O APIC` (ioapic.c:415-427, reached via
  ioapic_abi.c:1038 `ioapic_gsi_pin(map->im_gsi)`).
- INVARIANTS kernel: the same trigger panics at the debug assert
  `panic: assertion "irq >= 0 && irq < ioapic_abi_legacy_irq_max" failed in
  ioapic_abi_legacy_intr_config at ioapic_abi.c:999`.

Either way a single bad driver call — `bus_config_intr()` on an IRQ that
isn't a legacy map, e.g. the MSI/MSI-X vector the driver itself just
allocated — is promoted to a kernel panic. The function returns void; no
error path exists. On production kernels the guard KKASSERTs at
ioapic_abi.c:999/:1005 compile to nothing (sys/sys/systm.h:94-122), the
search loop at :1000-1004 falls through with cpuid==ncpus, and :1022/:1035
write flag/trigger fields into a wrong-type map before :1038 feeds
im_gsi=-1 into the gsi lookup. Fix validated: with runtime range/type
checks (early return) the identical kldload returns cleanly, no panic.

## Reproduction (baseline)

Production kernel (run_prodkernel.log):

    legacy_crash: msix_alloc rc=0 irq=24
    legacy_crash: calling legacy_intr_config(irq=24, LEVEL, LOW); production kernel should panic in ioapic_gsi_search (im_gsi == -1)
    panic: ioapic_gsi_search: no I/O APIC
    ioapic_gsi_search() at ioapic_gsi_search+0x3a 0xffffffff80b7350a
    Debugger("panic")

INVARIANTS kernel (panic_kkassert.txt — captured 07:58 UTC on the stock
X86_64_GENERIC):

    legacy_crash: ... irq=24
    panic: assertion "irq >= 0 && irq < ioapic_abi_legacy_irq_max" failed in ioapic_abi_legacy_intr_config at /usr/src/sys/platform/pc64/apic/ioapic_abi.c:999

Note on trigger selection: the first attempt used irq 19 and returned
*without* panic — on this QEMU guest irqs 16..23 are legacy level/low maps
(on some CPU), so ioapic_abi_legacy_intr_config() found a LEGACY map,
matched trig/pola, and took the early return at ioapic_abi.c:1024-1025.
The module therefore loops msix_alloc until it lands an irq >= 24. This
also documents the correct-behavior baseline: valid legacy requests are
unaffected.

## Impact

DoS/panic from privileged (driver) misuse; no memory corruption on the
demonstrated path (the -1 gsi reaches ioapic_gsi_search which panics by
design instead of indexing OOB). No unprivileged entry point. Severity
Low. Same pattern class as DF-5351: INVARIANTS-only guards on a
driver-facing ABI (also cited: ioapic_abi_legacy_intr_cpuid ioapic_abi.c:1121
silently returning cpu0, ioapic_abi_msi_map ioapic_abi.c:1413 passing
im_msi_base=-1 to msi_map for non-MSI intrs — benign values, no memory
unsafety).

## Fix validation (fix.diff)

Applied to guest /usr/src, incremental X86_64_NOINV rebuild (#1 08:38:15),
reboot, identical PoC (run_fixed.log):

    legacy_crash: msix_alloc rc=0 irq=24
    legacy_crash: calling legacy_intr_config(irq=24, LEVEL, LOW); ...
    legacy_crash: RETURNED WITHOUT PANIC (unexpected)
    LC_RC=0, guest up

No panic; correct legacy configurations (irq 19 path) still take the
normal route; MSI-X allocations/releases unaffected.

## poc_changes

- DECLARE_MODULE moduledata_t form (see DF-5351 VERDICT).
- Loop msix allocations until irq >= 24 (irqs 16..23 are legacy on this
  guest) — the naive "first msix irq" trigger hits a real legacy map and
  returns cleanly.
- Built with the in-tree module recipe (see build.sh).

## Kernel references

- sys/platform/pc64/apic/ioapic_abi.c:987-1053 (ioapic_abi_legacy_intr_config)
- sys/platform/pc64/apic/ioapic_abi.c:999, :1005 (KKASSERT-only guards)
- sys/platform/pc64/apic/ioapic_abi.c:1022, :1035-1036, :1038 (wrong-map writes + gsi_pin(-1))
- sys/platform/pc64/apic/ioapic_abi.c:763-764 (im_gsi/im_msi_base init to -1)
- sys/platform/pc64/apic/ioapic.c:409-427 (ioapic_gsi_pin → ioapic_gsi_search → panic)
- sys/sys/systm.h:94-122 (asserts compiled out without INVARIANTS)
- sys/sys/machintr.h:110 (machintr_legacy_intr_config macro — driver-facing)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.