{
  "finding_id": "DF-5407",
  "title": "uplcom_attach() pins the per-bus USB explore thread for up to ~70 s per insertion: 14 sequential synchronous EP0 vendor requests at the 5000 ms USB_DEFAULT_TIMEOUT (uplcom_reset + uplcom_pl2303_init), which an evil PL2303-VID:PID device stretches by answering each request successfully at just-under-timeout",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "on the guest: sh /root/df5407/build.sh  (awk-extracts uplcom_reset/uplcom_pl2303_do/uplcom_pl2303_init VERBATIM from the clean /usr/src snapshot of sys/bus/u4b/serial/uplcom.c, compiles them into the uplcomstall.ko harness, applies fix.diff to a scratch copy for phase B, and -Werror-compiles the whole patched file as uplcomfix5407.ko)",
    "run": "sh /root/df5407/run.sh  (kldload /root/df5407/uplcomstall.ko; kldunload; dmesg | grep HX5407)",
    "expected": "kldload blocks ~70 s; dmesg: 'HX5407[A]: uplcom_attach chain DONE: ~67300 ms pinned, 14 sync EP0 requests' then 'HX5407[B]: ... ~2200 ms' (fix.diff mechanism, 31x reduction)"
  },
  "kernel_refs": [
    "sys/bus/u4b/serial/uplcom.c:404-436",
    "sys/bus/u4b/serial/uplcom.c:460-525",
    "sys/bus/u4b/serial/uplcom.c:502-511",
    "sys/bus/u4b/usbdi.h:87",
    "sys/bus/u4b/usbdi.h:511-512",
    "sys/bus/u4b/usb_request.c:424-430",
    "sys/bus/u4b/usb_request.c:633-636",
    "sys/bus/u4b/usb_request.c:700-708",
    "sys/bus/u4b/usb_device.c:1316-1406",
    "sys/bus/u4b/usb_hub.c:530",
    "sys/bus/u4b/usb_hub.c:1103"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "uplcom_stall_harness.c",
    "build.sh",
    "run.sh",
    "fix.diff",
    "uplcom.fixed.c",
    "build.log",
    "fix_compile.log",
    "fix_build.log",
    "fix_run.log",
    "run.log",
    "run.2.log",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}