{
  "finding_id": "DF-5382",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Mechanism-level reproduction with production code: umcs7840_intr_callback (umcs.c:756/766) issues synchronous 500ms-timeout EP0 control requests from the xfer-callback context, which executes on the single shared per-bus callback thread bus->non_giant_callback_proc (usb_transfer.c:1009-1014,2286-2306,2437). A harness driving the real in-kernel usb_process machinery with the production per-request cost (500ms WXFER timeout + hz/16 error pause, 4 ports) shows any other devices completed transfer on the same bus delayed 2226/2240/2230-class ms per crafted 13-byte interrupt packet (all port bytes 0x00 -> MSCHANGE path; failed reads only break the inner switch at umcs.c:757/767 so all 4 ports pay), repeatable every packet for as long as the evil device streams -- sustained bus-wide USB callback starvation (keyboard/storage/network on the same controller). Fix mechanism from fix.diff (defer LSR/MSR refresh to the ucom super taskqueue) measures 0 ms. End-to-end with a physical crafted MCS7840 is not possible on this guest (no device model), hence the KLD-harness evidence class.",
  "exploit_chain": "evil USB device presents MOSCHIP MCS7840 VID/PID + 4-port GPIO bit -> umcs7840 attaches -> device streams 13-byte interrupt packets with all port bytes 0x00 (MSCHANGE, not NOPENDING) while never answering EP0 -> each packet costs the bus callback thread 4 x (500ms timeout + 62.5ms error pause) = 2250ms -> all other USB devices transfer callbacks on the bus starve indefinitely -> local DoS (USB input/storage frozen). No memory corruption; unplug ends it.",
  "evidence": "run.log lines HX5382[A]: victim delay after 1 packet = 2226 ms and stream rounds 2152-2168 ms across 3 loads; HX5382[B]: ... = 0 ms for the fix mechanism; VERDICT.md traces every link (umcs.c:729-790 -> usb_request.c:642-644,735-745 -> usb_transfer.c:2286-2306,2437); build.log/fix_compile.log show -Werror-clean builds of harness and patched driver",
  "kernel_refs": [
    "sys/bus/u4b/serial/umcs.c:729-790",
    "sys/bus/u4b/serial/umcs.c:756",
    "sys/bus/u4b/serial/umcs.c:766",
    "sys/bus/u4b/serial/umcs.h:33",
    "sys/bus/u4b/usb_transfer.c:1009-1014",
    "sys/bus/u4b/usb_transfer.c:2286-2306",
    "sys/bus/u4b/usb_transfer.c:2437",
    "sys/bus/u4b/usb_request.c:642-644",
    "sys/bus/u4b/usb_request.c:735-745"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch. One build iteration: usb_proc_msignaled helpers must be declared before first use and the unused slow-ok helper removed (-Werror). Also note SRCS needs usbdevs.h for driver compiles (only for fix compile-check, not the harness).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 540,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/bus/u4b/serial/hx5382 && make (in-tree kmod build; see build.sh)",
  "run_cmd": "kldload /root/df5382/umcsbusfreeze.ko; kldunload umcsbusfreeze; dmesg | grep HX5382 (see run.sh)",
  "code_hash": "75370e781302f7a415525c2c1c0911e46700659ad83c6066fb15e07e1669b07a",
  "notes": "Guest cleaned after run (harness dirs + scratch removed, /usr/src umcs.c/umcs.h verified md5-identical to pristine). Related-but-distinct from DF-5383 (cfg-path stalls on the ucom tq); this one is the device-data-driven bus-wide variant. ucom core contract quote: usbd_do_request_proc is for cfg-task context (usb_request.c:756-757), which is exactly where fix.diff moves the reads.",
  "recommended_fix": "Record pending interrupt bytes in the xfer callback and defer the LSR/MSR register reads to the ucom super taskqueue via a usb_proc_msignaled status task (full diff in fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff is git-apply-able against sys/ (git apply --check passes); patched umcs.c compiles -Werror-clean as a kmod on the guest (fix_compile.log RC=0); harness Phase B runs the deferred-status pattern against the same production usb_process machinery: victim delay 2250-class ms -> 0 ms. Scope caveat: mechanism+compile level; end-to-end with a physical crafted MCS7840 device is not possible on this guest.",
  "fix_evidence": "fix.diff (sha256 4ea018b1...); fix_compile.log; run.log HX5382[B] ... = 0 ms lines; VERDICT.md Fix validation section"
}