{
  "finding_id": "DF-5383",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Mechanism-level reproduction with production code: umcs7840_cfg_open() chains 28 synchronous EP0 control requests on first open (umcs.c:423-512 incl. 6 from umcs7840_set_baudrate at umcs.c:1022-1046) and umcs7840_cfg_close() 4 more (umcs.c:527-534), each with UMCS7840_CTRL_TIMEOUT=500ms (umcs.h:33). An evil device can NAK each control data stage to just under the timeout so every request succeeds slowly and no error-abort fires, making one open+close cost ~16s of ucom-taskqueue occupancy. A harness using the production usb_proc_create/msignal/mwait machinery with the production per-request cost shows the closer thread (ucom_closes synchronous usb_proc_mwait at usb_serial.c:671-672, uninterruptible cv_wait at usb_process.c:385-393) blocked 15702/15707/15700 ms across three runs; unplug racing a cfg task stalls the hub event thread the same way via ucom_detachs usb_proc_drain (usb_serial.c:394) -- the DF-5367 mechanism, umcs instance. Fix mechanism (timeout bounded to 100 ms, fix.diff) measures 3228/3232/3213 ms. End-to-end with a physical crafted MCS7840 is not possible on this guest (no device model), hence the KLD-harness evidence class.",
  "exploit_chain": "evil USB device (MCS7840 VID/PID) enumerates normally, then answers every vendor control request with the data stage NAKd for ~499 ms -> open(/dev/ttyUx.0) queues cfg_open costing ~14 s on the ucom tq; close(2) (root/wheel on ttyU, dialer group on cuaU) blocks uninterruptibly ~16 s behind it via usb_proc_mwait; unplug mid-cycle wedges the USB hub event thread identically via usb_proc_drain. Repeatable per open/close cycle. No memory corruption.",
  "evidence": "run.log lines HX5383[A]: closer: unblocked  ELAPSED=15702/15707/15700 ms vs HX5383[B]: ... 3228/3232/3213 ms; VERDICT.md counts all 28+4 requests with umcs.c line cites and traces the close/unplug blocking path; build.log/fix_compile.log show -Werror-clean builds of harness and patched driver",
  "kernel_refs": [
    "sys/bus/u4b/serial/umcs.c:410-515",
    "sys/bus/u4b/serial/umcs.c:517-537",
    "sys/bus/u4b/serial/umcs.h:33",
    "sys/bus/u4b/serial/usb_serial.c:671-672",
    "sys/bus/u4b/serial/usb_serial.c:394",
    "sys/bus/u4b/usb_request.c:642-644",
    "sys/bus/u4b/usb_process.c:385-393"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch. Built clean on the first compile after applying the DF-5367 harness lessons (bsd.kmod.mk, opt_usb.h/device_if.h/bus_if.h SRCS).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/bus/u4b/serial/hx5383 && make (in-tree kmod build; see build.sh)",
  "run_cmd": "kldload /root/df5383/umcscfgstall.ko; kldunload umcscfgstall; dmesg | grep HX5383 (see run.sh)",
  "code_hash": "4ebb7d59f74e60432ff183332f40de0fceeb3420604c147ded832b4efe451034",
  "notes": "Guest cleaned after run (scratch removed, /usr/src umcs.c/umcs.h verified md5-identical to pristine). Bounded per-cycle stall (Low, consistent with DF-5359/DF-5367 ratings); the companion DF-5382 is the unbounded device-driven variant on the shared bus thread.",
  "recommended_fix": "Bound UMCS7840_CTRL_TIMEOUT to 100 ms (one-line umcs.h change, full diff in fix.diff) so the 28+4-request open/close chain cannot exceed ~3.2 s; optionally also cap the whole cfg_open sequence",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff is git-apply-able against sys/ (git apply --check passes); the patched driver (pristine umcs.c + patched umcs.h) compiles -Werror-clean as a kmod on the guest (fix_compile.log RC=0); harness Phase B with the bounded timeout measures closer block 15702-class ms -> 3228-class ms (5x reduction of the stall ceiling). Scope caveat: mechanism+compile level; end-to-end with a physical crafted device is not possible on this guest.",
  "fix_evidence": "fix.diff (sha256 ab01b449...); fix_compile.log; run.log HX5383[B] ELAPSED=3228/3232/3213 ms; VERDICT.md Fix validation section"
}