{
  "finding_id": "DF-5395",
  "status": "reproduced",
  "verdict": "Deterministic kernel panic at USB device plug-in: axge_attach()s usbd_transfer_setup() failure branch (if_axge.c:555-558 allocating USB transfers failed) goto-jumps into the full axge_detach() (if_axge.c:573-575) while the embedded usb_ether is still entirely zeroed (ue_lock/ue_dev/ue_udev/ue_methods/ue_tq are assigned only at if_axge.c:560-564, AFTER the failing call; before it only device_set_usb_desc() at :549 and lockinit(&sc->sc_lock) at :550 have run). axge_detach() then calls uether_ifdetach(ue) (if_axge.c:587), which lockmgr()s through the NULL ue_lock (Fatal trap 12, fault VA 0x0, Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi) - the same DF-5334 (if_cdce) / DF-5384 (if_aue) class: usb_proc_drain() no-ops on the zeroed ue_tq and the ifp!=NULL guard is dead code because uether_getifp() returns the embedded arpcom ifnet. The trigger is fully device-controlled: any evil USB adapter presenting one of the 4 axge_devs[] VID:PID pairs (ASIX AX88179 0b95:1790, AX88178A 0b95:178a, D-Link DUB1312 2001:4a00, Sitecom LN032 0df6:062c) at config 0/iface 0 without the expected bulk-in/out endpoints fails the transfer setup. The second failure branch (uether_ifattach error, only on usb_proc_create ENOMEM) additionally runs usb_callout_drain() on a never-initialized watchdog and ether_ifdetach() on a never-if_attach()ed ifnet -> ifindex2ifnet[0] nulling + global ifnet list corruption + double devfs_clone_bitmap_put() of ue_unit. Verified with a KLD harness replaying axge_detach() verbatim (its two production calls in order) on the exact branch-1 state, using production usbd_transfer_unsetup()+uether_ifdetach(): baseline on pristine with-src guest with stock uether.ko -> Fatal trap 12 VA 0x0, guest dead in DDB (panic.txt); with fix.diff ((a) uether_ifdetach early-return on NULL ue_lock + (b) axge_attach detach_usb label doing only unsetup+lockuninit, required for branch 2) both modules rebuilt -Werror clean, patched uether.ko installed, and the identical harness run SURVIVED with KLDLOAD_RC=0, 0 Fatal traps, clean kldunload (twice), patched if_axge.ko loads/unloads clean (run.log). Not memory corruption with attacker-controlled data: fixed-address NULL deref at plug time; impact is panic/DoS from physical/VM USB access, same tier as DF-5334/DF-5384 (Medium).",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "panic.txt (baseline serial: 3 axge_poc markers with ue_lock=0 ue_dev=0 ue_udev=0 ue_tq.up_lock=0 -> Fatal trap 12, fault virtual address = 0x0, current process = kldload, Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> prompt); run.log (patched run: SURVIVED marker, KLDLOAD_RC=0, kldstat, UNLOAD_OK twice, FATAL_COUNT=0, patched if_axge.ko DRIVER_LOAD_OK/DRIVER_UNLOAD_OK); build.log + fix_uether_build.log + fix_if_axge_build.log (-Werror clean builds); env.txt (guest uname/kldstat/dmesg); fix.diff (git-apply-able against clean sys/, git apply --check OK)",
  "kernel_refs": [
    "sys/bus/u4b/net/if_axge.c:549-558",
    "sys/bus/u4b/net/if_axge.c:560-564",
    "sys/bus/u4b/net/if_axge.c:566-575",
    "sys/bus/u4b/net/if_axge.c:579-591",
    "sys/bus/u4b/net/usb_ethernet.c:61",
    "sys/bus/u4b/net/usb_ethernet.c:133-137",
    "sys/bus/u4b/net/usb_ethernet.c:262",
    "sys/bus/u4b/net/usb_ethernet.c:267-305",
    "sys/bus/u4b/usb_process.c:397-410"
  ],
  "poc_changes": "No seeded PoC existed. Wrote axge_attach_poc.c from scratch: KLD harness (MODULE_DEPEND uether) that kmallocs a zeroed struct axge_softc, lockinit()s sc->sc_lock exactly as if_axge.c:550 does (the only softc initialisation before the failing usbd_transfer_setup() at :553), prints the zeroed ue state, then replays axge_detach() verbatim: production usbd_transfer_unsetup(sc->sc_xfer, AXGE_N_TRANSFER) (if_axge.c:586) + production uether_ifdetach(&sc->sc_ue) (if_axge.c:587). Initial builds failed -Werror twice on the verbatim-quoted source block in the header comment (nested /* from the quoted /* failure */ token closed the harness comment, UTF-8 apostrophes/em-dashes from the aue template) - fixed by flattening the quoted comment to ASCII without nested comment tokens; final build -Werror clean. Physical AX88179 emulation is infeasible in QEMU; static axge_attach/axge_detach cannot be linked against, so the branch-1 state + exact call sequence replay is the strongest runnable evidence and uses only production code after the goto.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64",
  "runtime_sec": 960,
  "guest_dirty": 0,
  "build_cmd": "in-guest: mkdir -p /root/df5395 && cd /root/df5395 && make -m /usr/src/share/mk   (harness; fix validation additionally: cd /usr/src/sys/bus/u4b/net/uether && make -m /usr/share/mk; cd /usr/src/sys/bus/u4b/net/axge && make -m /usr/share/mk; cp uether.ko /boot/kernel/)",
  "run_cmd": "in-guest: kldload -v /root/df5395/axge_poc.ko   # baseline: Fatal trap 12 VA 0x0 (stock uether.ko auto-loaded); patched: SURVIVED + RC=0",
  "code_hash": "46d940efa5f309fa5f05838c23e585f7eee34af35a852710ac81db9559cd5a91",
  "notes": "Pass-2 audit of if_axge.c (GLM 5.3): everything else on the USB-net checklist proven BOUNDED. (a) RX pseudo-header/aggregation loop (axge_rx_frame if_axge.c:926-975): actlen<=65536 (bufsize, config :156), trailer rxhdr read at actlen-4; pkt_cnt<=0xffff but loop breaks when hdr_off+4>actlen (:950) or (int)pos>=actlen (:954) - no uint32/int overflow since pos<actlen+8192; pktlen=(pkt_hdr>>16)&0x1fff<=8191 (:961); guard pktlen>=6 && pos+pktlen<=actlen (:966) makes the rxeof read pos+2..pos+pktlen-4 land inside the transfer buffer; axge_rxeof (:985-999) rejects len<14 || len>2046 and copies into a fresh MCLBYTES(2048) cluster after m_adj(ETHER_ALIGN) - exact fit. usbd_copy_in/out do NOT bounds-check (usb_busdma.c:119-149) so the driver guards are the only defence - they hold. (b) TX (:655-696): frames=16 * MCLBYTES bufsize; per-frame budget 2048; max legal m_pkthdr.len is 1514 (ether_ioctl SIOCSIFMTU caps MTU at ETHERMTU=1500, if_ethersubr.c) or 1518 with VLAN - 8+1518<2048, no overflow; dead store txhdr|=0x80008000 (:672-673, flag never copied; FreeBSD dropped the line) is cosmetic. (c) MII: axge_read_cmd_2 returns uninitialized stack on failed control request (if_axge.c:251-259) - value only feeds mii media state, killed; statchg tmp[5] fully covered by the three memcpy paths after subtype validation (:342-388). (d) attach lifecycle: the finding above (same class as DF-5334/DF-5384 siblings). (e) CRC_ERR/DROP_ERR frames bump ierrors but are still delivered (:962-967) and rxeof marks csum-valid off device bits without capenable/L3-type gating - both inside the evil-NIC trust model (device is the checksum authority), upstream divergences are correctness-only; FreeBSD current axge_rx_frame bounds pos against pkt_end instead of actlen - DFs actlen bound is not memory-unsafe. setmulti 6-bit hash into 8-byte table (:758-764) bounded; SIOCSIFCAP under AXGE_LOCK re-inits via task - serialized on ue_tq. Guest: baseline panic on pristine with-src snapshot, fix validated in-guest, reset to with-src afterwards (clean hand-off).",
  "recommended_fix": "axge_attach(): route both pre-attach failures to a detach_usb label doing only usbd_transfer_unsetup()+lockuninit(); uether_ifdetach(): early-return when ue->ue_lock==NULL (class-wide, same as DF-5334/DF-5384 fix)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied in-guest to /usr/src (patch(1) Plan A, both files, all hunks); uether.ko and if_axge.ko rebuilt -Werror clean; patched uether.ko installed into /boot/kernel; the IDENTICAL harness re-run printed axge_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg|grep -c Fatal trap = 0, kldunload clean (run twice - stable), and the patched if_axge.ko driver module loads/unloads clean. Baseline panic record in panic.txt, patched survival in run.log. fix.diff verified git-apply-able against the clean read-only sys/ tree.",
  "fix_evidence": "run.log (SURVIVED marker + KLDLOAD_RC=0 + kldstat + UNLOAD_OK x2 + FATAL_COUNT=0 + DRIVER_LOAD_OK/DRIVER_UNLOAD_OK); fix_uether_build.log / fix_if_axge_build.log (-Werror clean); panic.txt (baseline trap on identical input); fix.diff (git apply --check OK on clean tree)"
}