{
  "finding_id": "DF-5424",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Mechanism-level reproduction with production machinery (KLD harness driving the real usb_proc taskqueue ucoms cfg callbacks run on, with uftdis exact request counts and 1000 ms timeouts): uftdi_cfg_open() (uftdi.c:354-387) chains 2 and uftdi_cfg_param() (uftdi.c:665-703) chains 3 sequential synchronous 1000 ms-timeout EP0 vendor requests, every return value discarded, plus hz/10 ucom pauses - an evil FTDI that never answers the control data stage stretches every open(2)+close(2) to ~5.0 s of ucom-taskqueue occupancy and every tcsetattr to ~3.1 s (two queued tcsetattrs ~8.1 s), blocking close(2) uninterruptibly (usb_proc_mwait, usb_serial.c:671-672) and stalling the USB hub event thread on unplug (usb_proc_drain, usb_serial.c:394). Measured: 5015 ms (open+1 tcsetattr+close), 8139 ms (open+2), 2116 ms with the fix.diff abort mechanism. Live-device cross-check: on the well-behaved QEMU FTDI the synchronous close wait is directly observed at 330-390 ms. Family-consistent with DF-5367/5383/5407/5421 (umcs7840/uplcom/uchcom).",
  "exploit_chain": "evil USB adapter with an FTDI VID/PID (probe is a pure table match, uftdi.c:205-269) enumerates as uftdi and never answers vendor control data stages -> every open/tcsetattr of the tty costs seconds of taskqueue occupancy; a local user with the port open (/dev/cuaU* 0660 uucp:dialer) multiplies it via the sc_param_task[2] double buffer; close(2) and unplug block uninterruptibly behind the chain.",
  "evidence": "run.log dmesg lines HX5424[A]: closer: unblocked ELAPSED=5015 ms, HX5424[2]: ... 8139 ms, HX5424[B]: ... 2116 ms; build.log (-Werror clean in-tree kmod); fix_compile.log (patched production uftdi.c compiles clean as uftdifix5424.ko); live baseline close ~= 330-390 ms in DF-5422s run logs",
  "kernel_refs": [
    "sys/bus/u4b/serial/uftdi.c:354-387",
    "sys/bus/u4b/serial/uftdi.c:665-703",
    "sys/bus/u4b/serial/uftdi.c:494-554",
    "sys/bus/u4b/serial/usb_serial.h:220-221",
    "sys/bus/u4b/serial/usb_serial.c:671-672",
    "sys/bus/u4b/serial/usb_serial.c:322",
    "sys/bus/u4b/usb_request.c:642-644"
  ],
  "poc_changes": "No seed PoC existed; adapted from the accepted DF-5421 family harness (uchcom) with uftdis production numbers (2 open-requests, 3 param-requests, 1000 ms each, hz/10 pauses).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/bus/u4b/serial/hx5424 && make (in-tree kmod build, -Werror clean; see build.sh)",
  "run_cmd": "kldload /root/df5424/uftdicfgstall.ko; kldunload uftdicfgstall; dmesg | grep HX5424 (see run.sh)",
  "code_hash": "153c6c3a2fbef45983aafad569aaf3811b13ad9a08bebdff19c06bf518028edb",
  "notes": "QEMUs usb-serial device model answers all FTDI control requests in microseconds, so the evil-device stall magnitudes come from the harness at exact production costs (the mandated evidence class for this family; identical methodology to DF-5421). Live uftdi attach/open/close/write/read/unplug/reset all exercised against the real device model in the DF-5422/5423 packs of this run.",
  "recommended_fix": "Check the ucom_cfg_do_request return in uftdi_cfg_open and at each uftdi_cfg_param step; abort the chain on the first failed request (full diff in fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff is git-apply-able against sys/ (git apply --check passes, host repo); the patched production driver compiles -Werror-clean as the uftdifix5424.ko kmod on the guest (fix_compile.log, same compile-check method as DF-5407); the abort-on-first-error mechanism is validated by harness phase B (2116 ms vs 5015 ms baseline; convention matches the DF-5421 family pack). No full patched-kernel boot was performed.",
  "fix_evidence": "fix.diff (git apply --check OK); fix_compile.log (uftdifix5424.ko built); run.log HX5424[B]: closer: unblocked ELAPSED=2116 ms with request 1/2 failed (USB_ERR_TIMEOUT) -> abort chain (fixed)"
}