{
  "finding_id": "DF-5359",
  "status": "untested",
  "verdict": "Code-certain bounded DoS, untested on the rig because the precondition (a USB device matching uipaqs VID:PID table with an unresponsive control endpoint) cannot be presented by any QEMU 7.2 device model: -device usb-serial is Netchip 0525:7701 which binds uftdi, and no vendorid/productid override property exists for usb-net/usb-storage (verified via -device <model>,help). uipaq_attach() (uipaq.c:1129-1136) retries the magic SET_CONTROL_LINE_STATE request 64 times with a 100ms request timeout plus an unconditional ~100ms pause and no early-out on stall/device-gone; the loop runs on the per-bus USB explore thread inside usb_probe_and_attach() (usb_device.c:1286-1345) while the device enum lock is held (usb_device.c:1324), so a crafted device from the ~300-entry uipaq_devs[] table stalls all hub-event processing for that bus ~6.4-12.8s per insertion, repeatably via replug. Attack surface is real on the stock guest (/boot/kernel/uipaq.ko present, auto-loads on device match; not loaded otherwise per kldstat). Severity Low (physical crafted device, bounded delay, no memory-safety impact) -> Phase V skipped per audit contract for Low/Info findings.",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "Attacker with physical USB access plugs a scripted device (e.g. Facedancer/gadget board) presenting a uipaq_devs[] VID:PID (e.g. 0x049f:0x0032, uipaq.c:300) whose EP0 NAKs or STALLs the class-interface request; uipaq.ko auto-loads and uipaq_attach burns 6.4-12.8s on the buss USB explore thread (replug to repeat), delaying enumeration/detach of all other USB devices on that bus. No escalation path - availability only.",
  "evidence": "README.md (bug arithmetic + manual Facedancer reproduction steps); VERDICT.md (why untested: no QEMU device model can present a uipaq VID:PID; usb-serial binds uftdi); fix.diff (retry-only-on-timeout + 16-iteration cap). Guest-side surface check: /boot/kernel/uipaq.ko exists, not loaded by default.",
  "kernel_refs": [
    "sys/bus/u4b/serial/uipaq.c:1124-1136",
    "sys/bus/u4b/serial/uipaq.c:150-1061",
    "sys/bus/u4b/usb_device.c:1286-1345",
    "sys/bus/u4b/usb_device.c:1324",
    "sys/bus/u4b/usb_hub.c:995-1090"
  ],
  "poc_changes": "None - no seed PoC existed and none was buildable: the finding requires a physical/scriptable crafted USB device that NAKs or STALLs EP0 control requests, which no QEMU 7.2 device model can emulate (verified -device usb-net,help / usb-storage,help have no vendorid override; usb-serials fixed 0525:7701 binds uftdi).",
  "attempts": 0,
  "guest_uname": "not booted for this finding; guest of record: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (no PoC build; hardware precondition)",
  "run_cmd": "n/a - manual procedure in README.md (Facedancer presenting 0x049f:0x0032 with NAK-ing EP0)",
  "code_hash": "",
  "notes": "Pass-2 file result: uipaq.c is thin family-glue on the ucom core; the only uipaq-specific actionable defect is this attach stall. Core-owned defects NOT re-reported here: DF-5320 (unplug lifecycle UAF via dangling tty t_sc/t_oproc - uipaq is a consumer; detach order ucom_detach->usbd_transfer_unsetup->lockuninit at uipaq.c:1166-1176 is byte-identical to uftdi/umct/uplcom/umodem/ubsa and adds no driver-specific hazard) and DF-2959 (TX clist_qtob). Upstream FreeBSD uipaq.c carries the identical 64-iteration loop - coordinate fix upstream.",
  "recommended_fix": "Retry the magic request only while it times out (error == USB_ERR_TIMEOUT), break immediately on success/stall/device-gone, and cap iterations at 16 (~3s worst case instead of ~13s) - see fix.diff.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation not applicable: no baseline reproduction was possible on the rig (no QEMU device model can present a uipaq-table VID:PID), so there is no observable to compare against. fix.diff is authored from the verified line-level root cause; the retry-only-on-timeout semantics preserve the WinCE warm-up behavior while bounding the stall.",
  "fix_evidence": "fix.diff (git-apply-able, never applied to sys/)"
}