# DF-5397 VERDICT

**Status: reproduced (deterministic kernel panic / local-device DoS via
attach-failure path). Fix: validated on the guest.**

## How reproduced

The malicious usbredir RNDIS device (usbredir_rndis.py from the DF-5396
pack, `RNDIS_MALFORMED=1`) presents CDC class-specific descriptors whose
walked lengths are one byte too long each, so DF's config parse never
finds the data interface and `urndis_attach()`\'s alternate-setting loop
fails on every iteration -> "No valid alternate setting found" ->
`goto detach` -> `urndis_detach(dev)` -> `uether_ifdetach()` over the
never-initialised usb_ether -> `lockmgr(NULL)` -> Fatal trap 12, VA 0.

Four independent baseline reproductions (two descriptor-failure variants:
alt-setting failure and MAC-query rejection), each with the DDB backtrace
naming uether_ifdetach+0x2f <- urndis_detach+0x2a <- urndis_attach, and a
crash dump via `call dumpsys`. Evidence: panic.txt,
run.serial-baseline-panic-usbdebug.log (USB_DEBUG kernel, annotated),
run.serial-baseline-panic2.log, run.serial-patched-clean.log.

## Why not worse than a panic

The faulting pointer is NULL (ue_lock), so the primitive is a
denial-of-service at attach time (device plug-in / boot with the evil
gadget present). Because the panic happens with preemption state of the
usb explore thread and a fully attacker-chosen timing window, it is also
a reliability/UX kill: a boot-time evil device bricks the boot (serial
DDB, ssh never starts). No memory-corruption primitive was identified in
this path (the NULL is dereferenced, not written through).

## Fix validation

fix.diff (tear down only usbd transfers + lock, never uether_ifdetach on
the un-attached ue) applied on the guest, module rebuilt + installed:

* malformed device replug: `urndis0: No valid alternate setting found` +
  `device_probe_and_attach: urndis0 attach returned 6`, guest alive,
  zero Fatal traps.
* valid device (regression): full attach + DF-5396 differential ran on
  the same patched module build (ue0 up, RNDIS data path live).

## Notes

* cdce (DF-5334) shares the bug and must be kept from probing first for
  this driver's PoC (VPI 0525:a4a2 beats urndis's class match).
* FreeBSD's urndis_attach has the same shape; whether FreeBSD's
  uether_ifdetach is equally unguarded was not verified in this run.

## Kernel references

sys/bus/u4b/net/if_urndis.c:290-294, :309-311;
sys/bus/u4b/net/usb_ethernet.c:268-314; DF-5334 (cdce sibling).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.