{ "finding_id": "DF-5399", "status": "reproduced", "verdict": "Deterministic kernel panic at USB device plug-in: mos_attach()s usbd_transfer_setup() failure branch (if_mos.c:704-707 allocating USB transfers failed) goto-jumps into the full mos_detach() (if_mos.c:730-732) while the embedded usb_ether is still entirely zeroed (ue_lock/ue_dev/ue_udev/ue_methods/ue_tq are assigned only at if_mos.c:708-712, AFTER the failing call; before it only sc->mos_flags at :694, device_set_usb_desc() at :696 and lockinit(&sc->sc_lock) at :697 have run). mos_detach() then calls uether_ifdetach(ue) (if_mos.c:763), which lockmgr()s through the NULL ue_lock (Fatal trap 12, fault VA 0x0, Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi) - the same DF-5334 (if_cdce) / DF-5384 (if_aue) / DF-5395 (if_axge) / DF-5397 (if_urndis) class: usb_proc_drain() no-ops on the zeroed ue_tq and the ifp!=NULL guard is dead code because uether_getifp() returns the embedded arpcom ifnet. The trigger is fully device-controlled: any evil USB adapter presenting one of the 4 mos_devs[] VID:PID pairs (MosChip 0x9710:0x7730 / 0x9710:0x7830 / 0x9710:0x7832, Sitecom LN-030 0x0df6:0x0021) at config 0/iface 0 - mos_probe() (if_mos.c:664-679) matches IDs only, never descriptors - without the bulk-IN/OUT endpoints fails the transfer setup with USB_ERR_NO_ENDPOINT. The second failure branch (uether_ifattach error, only on usb_proc_create ENOMEM) additionally runs usb_callout_drain() on a never-initialized watchdog and ether_ifdetach() on a never-if_attach()ed ifnet -> ifindex2ifnet[0] nulling + global ifnet list corruption + double devfs_clone_bitmap_put() of ue_unit. Verified with a KLD harness replaying mos_detach() verbatim (its two production calls in order) on the exact branch-1 state, using production usbd_transfer_unsetup()+uether_ifdetach(): baseline on pristine with-src guest with stock uether.ko -> Fatal trap 12 VA 0x0, guest dead in DDB (panic.txt); with fix.diff ((a) uether_ifdetach early-return on NULL ue_lock + (b) mos_attach detach_usb label doing only unsetup+lockuninit, required for branch 2) both modules rebuilt -Werror clean, patched uether.ko installed, and the identical harness run SURVIVED with KLDLOAD_RC=0, 0 Fatal traps, clean kldunload (twice), patched if_mos.ko driver module loads/unloads clean (run.log). Not memory corruption with attacker-controlled data: fixed-address NULL deref at plug time; impact is panic/DoS from physical/VM USB access, same tier as DF-5334/DF-5384/DF-5395/DF-5397 (Medium).", "reproduced": true, "impact": "panic", "confidence": "certain", "exploit_chain": "", "evidence": "panic.txt (baseline serial: 3 mos_poc markers with ue_lock=0 ue_dev=0 ue_udev=0 ue_tq.up_lock=0 -> Fatal trap 12, fault virtual address = 0x0, current process = kldload, Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> prompt); run.log (patched run: SURVIVED marker, KLDLOAD_RC=0, UNLOAD_OK x2, FATAL_COUNT=0, patched if_mos.ko DRIVER_LOAD_OK/DRIVER_UNLOAD_OK); build.log + fix_uether_build.log + fix_if_mos_build.log (-Werror clean builds); env.txt (guest uname/kldstat); fix.diff (git-apply-able against clean sys/, git apply --check OK)", "kernel_refs": [ "sys/bus/u4b/net/if_mos.c:694-707", "sys/bus/u4b/net/if_mos.c:708-712", "sys/bus/u4b/net/if_mos.c:722-732", "sys/bus/u4b/net/if_mos.c:756-767", "sys/bus/u4b/net/usb_ethernet.c:61", "sys/bus/u4b/net/usb_ethernet.c:133-137", "sys/bus/u4b/net/usb_ethernet.c:267-305", "sys/bus/u4b/usb_process.c:397-410" ], "poc_changes": "No seeded PoC existed. Wrote mos_attach_poc.c from scratch (aue DF-5384 harness shape, ASCII-only comments): KLD harness (MODULE_DEPEND uether) that kmallocs a zeroed struct mos_softc, lockinit()s sc->sc_lock exactly as if_mos.c:697 does (the only lock initialisation before the failing usbd_transfer_setup() at :700), prints the zeroed ue state, then replays mos_detach() verbatim: production usbd_transfer_unsetup(sc->sc_xfer, MOS_ENDPT_MAX) (if_mos.c:762) + production uether_ifdetach(&sc->sc_ue) (if_mos.c:763). Built -Werror clean on the first try. Physical MCS7730/7830 emulation is infeasible in QEMU; static mos_attach/mos_detach cannot be linked against, so the branch-1 state + exact call-sequence replay is the strongest runnable evidence and uses only production code after the goto.", "attempts": 2, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64", "runtime_sec": 480, "guest_dirty": 0, "build_cmd": "in-guest: cd /root/df5399 && make -m /usr/src/share/mk (harness; fix validation additionally: cd /usr/src/sys/bus/u4b/net/uether && make -m /usr/share/mk; cd /usr/src/sys/bus/u4b/net/mos && make -m /usr/share/mk; cp uether.ko /boot/kernel/)", "run_cmd": "in-guest: kldload -v /root/df5399/mos_poc.ko # baseline: Fatal trap 12 VA 0x0 (stock uether.ko auto-loaded); patched: SURVIVED + RC=0", "code_hash": "9af7011bdb5ed766b6358f35ccd3c26e00e4070034274da3c1334382807bc68e", "notes": "Pass-2 audit of if_mos.c (GLM 5.3): everything else on the USB-net checklist proven BOUNDED. (a) RX (mos_bulk_read_callback, if_mos.c:776-843): actlen <= bufsize MCLBYTES+4+ETHER_CRC_LEN=2056 (config :204, short_xfer_ok); actlen<=1 rejected (:794); status byte read at actlen-1 with actlen>=2 guaranteed (:799); uether_rxbuf bounds len to [ETHER_HDR_LEN, MCLBYTES-ETHER_ALIGN] (usb_ethernet.c:589) and copies into a fresh MCLBYTES cluster after m_adj(ETHER_ALIGN) - no DF-5396-class overflow possible through this framework path. Two residual Info-grade defects filed separately (DF-5400 trailing status byte included in delivered frames - uether_rxbuf passed actlen not pktlen at :826, and 2045..2056-byte transfers silently dropped without ierrors; DF-5401 interrupt-callback stats/OOB-read-into-unused-local + double opackets in TX). (b) TX (:849-900): per-frame bufsize MCLBYTES+2=2050 (:194); max legal dequeued m_pkthdr.len is 1514/1518/1522 (ether_ioctl SIOCSIFMTU caps MTU at ETHERMTU=1500, sys/net/if_ethersubr.c:719-723; VLAN header +4) - bounded, no overflow; usbd_m_copy_in/usbd_copy_in do NOT bounds-check (usb_busdma.c:185-209) so the MTU cap is the only defence - it holds for non-root; BPF-write oversized frames need root (bpf devices root-only) - noted, not filed. (c) MII/register helpers (:416-519): lockowned()-gated MOS_LOCK with LK_CANRECURSE - no lock-order violation; MOS_TIMEOUT=1000 bounded busy-wait of 1s control requests (evil device can stall ~16min per MII access inside the ue taskqueue - inherent evil-USB DoS, bounded, not filed); mos_reg_read_1 returning -1 propagates into device register writes only (mos_miibus_statchg :489-512) - no kernel memory effect. (d) attach lifecycle: the finding above (5th instance of the DF-5334 class); normal-path detach ordering (unsetup before ifdetach) matches the family. (e) device-supplied data into m_adj/m_copyback/if_output: none beyond RX (status byte constant 0x20 for accepted frames - DF-5400); mos_setmulti 8-byte hashtbl with 6-bit hash (:593-611) and mos_write_mcast wLength=8 (:396-414) fully covered; mos_readmac reads exactly ETHER_ADDR_LEN device bytes into ue_eaddr (:354-372) - no kernel leak; mos_softc.ifp (if_mosreg.h:161) is a dead never-referenced member. Guest: baseline panic on pristine with-src snapshot, fix validated in-guest, reset to with-src afterwards, md5-verified pristine hand-off (guest_dirty=0).", "recommended_fix": "mos_attach(): route both pre-attach failures to a detach_usb label doing only usbd_transfer_unsetup()+lockuninit(); uether_ifdetach(): early-return when ue->ue_lock==NULL (class-wide, same as DF-5334/DF-5384/DF-5395 fix)", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff applied in-guest to /usr/src (patch(1) Plan A, both files, all hunks); uether.ko and if_mos.ko rebuilt -Werror clean; patched uether.ko installed into /boot/kernel; the IDENTICAL harness re-run printed mos_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg|grep -c Fatal trap = 0, kldunload clean (run twice - stable), and the patched if_mos.ko driver module loads/unloads clean. Baseline panic record in panic.txt, patched survival in run.log. fix.diff verified git-apply-able against the clean read-only sys/ tree.", "fix_evidence": "run.log (SURVIVED marker + KLDLOAD_RC=0 + UNLOAD_OK x2 + FATAL_COUNT=0 + DRIVER_LOAD_OK/DRIVER_UNLOAD_OK); fix_uether_build.log / fix_if_mos_build.log (-Werror clean); panic.txt (baseline trap on identical input); fix.diff (git apply --check OK on clean tree)" }