{
  "finding_id": "DF-5384",
  "status": "reproduced",
  "verdict": "Deterministic kernel panic at USB device plug-in: aue_attach()s usbd_transfer_setup() failure branch (if_aue.c:689-691 allocating USB transfers failed) goto-jumps into the full aue_detach() (if_aue.c:707-708) while the embedded usb_ether is still entirely zeroed (ue_lock/ue_dev/ue_udev/ue_methods/ue_tq are assigned only at if_aue.c:694-698, AFTER the failing call). uether_ifdetach() then lockmgr()s through the NULL ue_lock (Fatal trap 12, fault VA 0x0, Stopped at lockmgr_exclusive+0x5d) - the same DF-5334 (if_cdce) class: usb_proc_drain() no-ops on the zeroed ue_tq and the ifp!=NULL guard is dead code because uether_getifp() returns the embedded arpcom ifnet. The trigger is fully device-controlled: any evil USB adapter presenting one of the 68 aue_devs[] VID:PID pairs (e.g. ADMtek Pegasus 0x077b:0x2226) at config 0/iface 0 without the expected bulk/interrupt endpoints fails the transfer setup. The second failure branch (uether_ifattach error, only on usb_proc_create ENOMEM) additionally runs ether_ifdetach() on a never-if_attach()ed ifnet -> ifindex2ifnet[0] nulling + global ifnet list corruption. Verified with a KLD harness replaying aue_detach() verbatim (its two production calls in order) on the exact branch-1 state, using production usbd_transfer_unsetup()+uether_ifdetach(): baseline on pristine with-src guest with stock uether.ko -> Fatal trap 12 VA 0x0, guest dead in DDB (panic.txt); with fix.diff ((a) uether_ifdetach early-return on NULL ue_lock + (b) aue_attach detach_usb label doing only unsetup+lockuninit, required for branch 2) both modules rebuilt -Werror clean and the identical harness run SURVIVED with KLDLOAD_RC=0, 0 Fatal traps, clean unload (run.log). Not memory corruption with attacker-controlled data: fixed-address NULL deref at plug time; impact is panic/DoS from physical/VM USB access, same tier as DF-5334 (Medium).",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "panic.txt (baseline serial: 3 aue_poc markers -> Fatal trap 12, fault virtual address = 0x0, current process 987 (kldload), Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> prompt); run.log (patched run: SURVIVED marker, KLDLOAD_RC=0, kldstat, UNLOAD_OK, dmesg Fatal-trap count 0, patched if_aue.ko loads clean); build.log + fix_uether_build.log + fix_if_aue_build.log (-Werror clean builds); env.txt (guest uname/dmesg/kldstat); fix.diff (git-apply-able against clean sys/, git apply --check OK)",
  "kernel_refs": [
    "sys/bus/u4b/net/if_aue.c:686-692",
    "sys/bus/u4b/net/if_aue.c:694-700",
    "sys/bus/u4b/net/if_aue.c:707-709",
    "sys/bus/u4b/net/if_aue.c:712-720",
    "sys/bus/u4b/net/usb_ethernet.c:61",
    "sys/bus/u4b/net/usb_ethernet.c:133-137",
    "sys/bus/u4b/net/usb_ethernet.c:267-305",
    "sys/bus/u4b/usb_process.c:397-410",
    "sys/net/if.c:966",
    "sys/net/if.c:982"
  ],
  "poc_changes": "No seeded PoC existed. Wrote aue_attach_poc.c from scratch: KLD harness (MODULE_DEPEND uether) that kmallocs a zeroed struct aue_softc, lockinit()s sc->sc_lock exactly as if_aue.c:683 does (the only softc initialisation before the failing usbd_transfer_setup() at :686), prints the zeroed ue state, then replays aue_detach() verbatim: production usbd_transfer_unsetup(sc->sc_xfer, AUE_N_TRANSFER) (if_aue.c:718) + production uether_ifdetach(&sc->sc_ue) (if_aue.c:719). Initial build needed the full if_aue.c include block (sys/bus.h, sys/condvar.h, net/if_var.h) and generated headers in SRCS (opt_usb.h device_if.h bus_if.h usbdevs.h miibus_if.h opt_inet.h). Physical Pegasus emulation is infeasible in QEMU (no usbredir gadget available to this harness class); static aue_attach/aue_detach cannot be linked against, so the branch-1 state + exact call sequence replay is the strongest runnable evidence and uses only production code after the goto.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64",
  "runtime_sec": 580,
  "guest_dirty": 1,
  "build_cmd": "in-guest: mkdir -p /root/df5384 && cd /root/df5384 && make -m /usr/src/share/mk   (harness; fix validation additionally: cd /usr/src/sys/bus/u4b/net/uether && make; cd ../aue && make; cp uether.ko /boot/kernel/)",
  "run_cmd": "in-guest: kldload -v /root/df5384/aue_poc.ko   # baseline: Fatal trap 12 VA 0x0 (stock uether.ko auto-loaded); patched: SURVIVED + RC=0",
  "code_hash": "40e95b696c2874be1ddc21a4a2715afdc3cb51edd710c7e4efc7fe6637ce2e59",
  "notes": "Pass-2 audit of if_aue.c: everything else on the USB-net checklist proven BOUNDED - rx: non-VER_2 path strips sizeof(aue_rxpkt)+ETHER_CRC_LEN (8) from actlen<=2056 giving len<=2048 and VER_2 path passes raw actlen<=2056, but uether_rxbuf (usb_ethernet.c:589) rejects len>MCLBYTES-ETHER_ALIGN (2046) and copies at offset ETHER_ALIGN into a fresh MCLBYTES cluster -> exact fit, no OOB (oversize frames silently dropped); tx: pkthdr.len clamped to MCLBYTES (if_aue.c:866-867), frame len len+2 <= bufsize MCLBYTES+2, usbd_m_copy_in at offset 2 -> exact fit; intr callback guards actlen>=sizeof(pkt) (if_aue.c:740); mii/eeprom loops bounded by AUE_TIMEOUT with uether_pause breaks; eeprom MAC read fills ue_eaddr[0..5] exactly. Same DF-5334 pattern was the only finding. Guest found dirty from a prior reviewers umcs harness (DF-5382/5383); vm.sh reset with-src taken before baseline. Guest reset to with-src after validation.",
  "recommended_fix": "aue_attach(): route both pre-attach failures to a detach_usb label doing only usbd_transfer_unsetup()+lockuninit(); uether_ifdetach(): early-return when ue->ue_lock==NULL (class-wide, same as DF-5334 fix)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied in-guest to /usr/src (patch(1) Plan A, both hununks); uether.ko and if_aue.ko rebuilt -Werror clean; patched uether.ko installed into /boot/kernel; rebooted-equivalent clean session re-ran the IDENTICAL harness: aue_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg|grep -c Fatal trap = 0, kldunload clean, and the patched if_aue.ko driver module loads/unloads clean. Baseline panic record in panic.txt, patched survival in run.log. fix.diff verified git-apply-able against the clean read-only sys/ tree.",
  "fix_evidence": "run.log (SURVIVED marker + KLDLOAD_RC=0 + kldstat + UNLOAD_OK + Fatal-trap count 0); fix_uether_build.log / fix_if_aue_build.log (-Werror clean); panic.txt (baseline trap on identical input); fix.diff (git apply --check OK on clean tree)"
}