{ "finding_id": "DF-5411", "status": "reproduced", "verdict": "Deterministic kernel panic at USB device plug-in: udav_attach()s usbd_transfer_setup() failure branch (if_udav.c:265-268 allocating USB transfers failed) goto-jumps into the full udav_detach() (if_udav.c:293-295) while the embedded usb_ether is still entirely zeroed (ue_sc/ue_dev/ue_udev/ue_methods/ue_lock are assigned only at if_udav.c:280-283, AFTER the failing call at :263-264; the lockinit at :260 initialises sc_lock, not ue->ue_lock). uether_ifdetach() (if_udav.c:305) then lockmgr()s through the NULL ue_lock (Fatal trap 12, fault VA 0x0, Stopped at lockmgr_exclusive+0x5d) - the same DF-5334 (if_cdce) class already proved for aue/axge/urndis/mos: usb_proc_drain() no-ops on the zeroed ue_tq (usb_process.c:401-412) and the ifp!=NULL guard at usb_ethernet.c:278 is dead code because uether_getifp() (usb_ethernet.c:134) returns the embedded arpcom ifnet. The trigger is fully device-controlled: any evil USB adapter presenting one of the 6 udav_devs[] VID:PID pairs (if_udav.c:205-218; e.g. ShanTou DM9601 0x0fe6:0x8101, Corega FEther USB-TXC 0x07aa:0x0004, Kontron JP1082) at config 0/iface 0 without the expected bulk-IN/OUT endpoints fails the transfer setup at plug-in. The second failure branch (uether_ifattach error, only on usb_proc_create ENOMEM) additionally runs ether_ifdetach() on a never-if_attach()ed ifnet -> ifindex2ifnet[0] nulling + global ifnet list corruption. Verified with a KLD harness replaying udav_detach() verbatim (its two production calls in order) on the exact branch-1 state, using production usbd_transfer_unsetup()+uether_ifdetach(): baseline on pristine with-src guest with stock uether.ko -> Fatal trap 12 VA 0x0, guest dead in DDB (panic.txt); with fix.diff ((a) uether_ifdetach early-return on NULL ue_lock + (b) udav_attach detach_usb label doing only unsetup+lockuninit, dead detach: label dropped, required for branch 2) both modules rebuilt -Werror clean and the identical harness run SURVIVED with KLDLOAD_RC=0, 0 Fatal traps, clean unload, patched if_udav.ko loads/unloads clean (2/2 runs). Not memory corruption with attacker-controlled data: fixed-address NULL deref at plug time; impact is panic/DoS from physical/VM USB access, same tier as DF-5334 (Medium).", "reproduced": true, "impact": "panic", "confidence": "certain", "exploit_chain": "", "evidence": "panic.txt (baseline serial: 3 udav_poc markers -> Fatal trap 12, fault virtual address = 0x0, current process 1065 (kldload), Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> prompt); run.log (patched run: SURVIVED marker, KLDLOAD_RC=0, kldstat, UNLOAD_OK, dmesg Fatal-trap count 0, patched if_udav.ko loads/unloads clean, md5 match /boot/kernel/uether.ko vs patched build); build.log + fix_uether_build.log + fix_udav_build.log (-Werror clean builds); env.txt (guest uname/cc/kldstat + in-guest patch line confirmation); fix.diff (git-apply-able against clean sys/, git apply --check OK)", "kernel_refs": [ "sys/bus/u4b/net/if_udav.c:260", "sys/bus/u4b/net/if_udav.c:263-268", "sys/bus/u4b/net/if_udav.c:280-283", "sys/bus/u4b/net/if_udav.c:285-289", "sys/bus/u4b/net/if_udav.c:293-295", "sys/bus/u4b/net/if_udav.c:298-309", "sys/bus/u4b/net/if_udav.c:205-218", "sys/bus/u4b/net/usb_ethernet.c:58", "sys/bus/u4b/net/usb_ethernet.c:134", "sys/bus/u4b/net/usb_ethernet.c:162-186", "sys/bus/u4b/net/usb_ethernet.c:268-305", "sys/bus/u4b/usb_process.c:397-412" ], "poc_changes": "No seeded PoC existed. Wrote udav_attach_poc.c from scratch (aue DF-5384 harness pattern): KLD harness (MODULE_DEPEND uether) that kmallocs a zeroed struct udav_softc, lockinit()s sc->sc_lock exactly as if_udav.c:260 does (the only softc initialisation before the failing usbd_transfer_setup() at :263), prints the zeroed ue state, then replays udav_detach() verbatim: production usbd_transfer_unsetup(sc->sc_xfer, UDAV_N_TRANSFER) (if_udav.c:304) + production uether_ifdetach(&sc->sc_ue) (if_udav.c:305). First build hit -Werror=cast-qual printing ue_methods with (void*) cast - fixed by printing the const pointer directly. Physical DM9601 emulation is infeasible in QEMU (no device model); static udav_attach/udav_detach cannot be linked against, so the branch-1 state + exact call-sequence replay is the strongest runnable evidence and uses only production code after the goto.", "attempts": 3, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64", "runtime_sec": 620, "guest_dirty": 1, "build_cmd": "in-guest: mkdir -p /root/df5411 && cd /root/df5411 && make -m /usr/src/share/mk (harness; fix validation additionally: cd /usr/src/sys/bus/u4b/net/uether && make; cd ../udav && make; cp /usr/obj/.../uether/uether.ko /boot/kernel/)", "run_cmd": "in-guest: kldload -v /root/df5411/udav_poc.ko # baseline: Fatal trap 12 VA 0x0 (stock uether.ko auto-loaded); patched: SURVIVED + RC=0 + clean unload + if_udav.ko load/unload", "code_hash": "a20396f25f28eecfba0e6e7084c626165fd2abccad126442f188570c51a1170a", "notes": "Pass-2 audit of if_udav.c: everything else on the USB-net checklist proven BOUNDED - rx: actlen<=bufsize MCLBYTES+3 (if_udav.c:124), guard at :662 needs actlen>=sizeof(stat)+ETHER_CRC_LEN, len=min(actlen-3,pktlen)-4 <= MCLBYTES-4=2044; a device pktlen<4 makes len negative which wraps in uether_rxbufs unsigned len and is REJECTED by the usb_ethernet.c:589 guard (len>MCLBYTES-ETHER_ALIGN), copy lands at m_adj(ETHER_ALIGN)=2 in a 2048-cluster (2+2044=2046<=2048) -> no DF-5396 (MCLBYTES-ETHER_ALIGN) instance, oversize/runt frames merely dropped; tx: pkthdr.len clamped to MCLBYTES (if_udav.c:594-595), temp_len<=MCLBYTES+2=bufsize (:114), copy at offset 2 exact fit, usbd_frame_zero within budget (:617-618); mii: reg&UDAV_EPAR_EROA_MASK 5-bit (:813-814/:853-854), multicast hash h=crc32>>26<=63 into 8-byte table (:521-523); udav_csr_read1 uninit-return-on-error filed separately as DF-5412 (Info); udav_reset 1000xhz/100 loop = bounded 10s plug-time stall under sc_lock (same upstream, not filed). Guest dirty (patched /usr/src + /boot/kernel/uether.ko); vm.sh reset with-src taken after validation.", "recommended_fix": "udav_attach(): route both pre-attach failures to a detach_usb label doing only usbd_transfer_unsetup()+lockuninit() (drop the dead detach: label); uether_ifdetach(): early-return when ue->ue_lock==NULL (class-wide, same as DF-5334/5384 fix)", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64", "fix_verdict": "fix.diff applied in-guest to /usr/src (patch -p1, both files; first variant kept the dead detach: label and tripped -Werror=unused-label, final variant drops it); uether.ko and if_udav.ko rebuilt -Werror clean; patched uether.ko installed into /boot/kernel (md5 verified against patched build); identical harness re-run: udav_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg|grep -c Fatal trap = 0, kldunload clean, and the patched if_udav.ko driver module loads/unloads clean (2/2 runs). Baseline panic record in panic.txt, patched survival in run.log/fix_run.log. fix.diff verified git-apply-able against the clean read-only sys/ tree.", "fix_evidence": "run.log / fix_run.log (SURVIVED marker + KLDLOAD_RC=0 + kldstat + UNLOAD_OK + Fatal-trap count 0 + if_udav.ko LOAD/UNLOAD OK + md5 match of installed uether.ko); fix_uether_build.log + fix_udav_build.log + fix_build.log (-Werror clean); panic.txt (baseline trap on identical input); fix.diff (git apply --check OK on clean tree)" }