{ "finding_id": "DF-5425", "status": "reproduced", "reproduced": true, "impact": "dos", "confidence": "certain", "verdict": "Mechanism-level reproduction with production machinery: uslcom_param() (uslcom.c:505-583) chains 3 sequential synchronous EP0 vendor requests per tcsetattr (BAUD_RATE at 520, DATA at 557, SET_FLOWCTRL at 579) and uslcom_open()/uslcom_close() add 1 each (418, 442), all via ucom_cfg_do_request(...,1000) whose usb_error_t every call site discards (failed (ignored), uslcom.c:420/522/559/581/444), so no step ever aborts. An evil CP210x (VID/PID-table-only probe, uslcom.c:208-293) that never answers the control data/status stage makes each request eat its full 1000 ms timeout (usb_request.c:642-644, 699-704): ~3.1 s of per-adapter ucom taskqueue occupancy per tcsetattr, ~5.2 s per open+tcsetattr+close cycle. A harness on the production usb_proc_create/msignal/mwait machinery with uslcoms exact request counts shows the closer thread (ucom_closes synchronous usb_proc_mwait, usb_serial.c:671-672+955-957, uninterruptible cv_wait usb_process.c:385-393) blocked 5078/5090 ms behind open+1 tcsetattr and 8141/8094 ms behind open+2 tcsetattrs (local amplification via the sc_param_task double buffer, usb_serial.c:1691-1693); unplug mid-cycle stalls the USB hub event thread identically via ucom_detachs usb_proc_drain (usb_serial.c:394) -- the DF-5367 mechanism, uslcom instance. uslcom-specific amplifier: the open-time watchdog (uslcom.c:315-326) keeps an RCTRL control xfer in flight on the shared ep0 queue, adding up to ~1 s queue-wait per cfg request on top (floor measurements exclude it). fix.diff (param-chain abort on first error + USLCOM_CFG_TIMEOUT 250 ms for all cfg paths) measures 3149/3121 ms (abort) and 899/925 ms (abort+bound) and compiles -Werror-clean as the production in-tree uslcom.ko. No CP210x device model exists on the guest, hence the KLD-harness evidence class; availability-only impact, Low per family calibration (DF-5367/5383/5421/5424).", "exploit_chain": "evil USB device with one of 80+ uslcom VID:PID pairs enumerates as uslcom; local dialer-group user opens /dev/cuaU* (cfg_open ~1.1 s), then every ioctl(TIOCSETA) queues a 3-request ~3.1 s cfg_param task onto the per-adapter ucom taskqueue; close(2) blocks uninterruptibly behind the queued chain(s) ~5.2 s per cycle (~8.2 s with two queued tsetattrs), repeatable indefinitely; unplugging mid-cycle pins the per-bus USB hub event thread via usb_proc_drain for the in-flight chain.", "evidence": "run.log/run.2.log lines SL5425[A]: closer: unblocked ELAPSED=5078/5090 ms, SL5425[2]: ... 8141/8094 ms, SL5425[B]: ... 3149/3121 ms, SL5425[C]: ... 899/925 ms; VERDICT.md tables the 3+1+1 chain with uslcom.c line cites, traces the close/unplug blocking path, and records the pass-2 negative results (RCTRL short-response proof, divisor guard, watchdog/drain lifecycle); build.log/fix_compile.log show -Werror-clean builds of harness and patched production driver", "kernel_refs": [ "sys/bus/u4b/serial/uslcom.c:505-583", "sys/bus/u4b/serial/uslcom.c:514-523", "sys/bus/u4b/serial/uslcom.c:551-560", "sys/bus/u4b/serial/uslcom.c:573-582", "sys/bus/u4b/serial/uslcom.c:418-421", "sys/bus/u4b/serial/uslcom.c:442-445", "sys/bus/u4b/serial/uslcom.c:315-326", "sys/bus/u4b/serial/usb_serial.c:671-672", "sys/bus/u4b/serial/usb_serial.c:955-957", "sys/bus/u4b/serial/usb_serial.c:1691-1693", "sys/bus/u4b/serial/usb_serial.c:394", "sys/bus/u4b/usb_request.c:642-644", "sys/bus/u4b/usb_request.c:699-704", "sys/bus/u4b/usb_process.c:385-393" ], "poc_changes": "No seed PoC existed; authored from scratch on the DF-5421/DF-5383 harness pattern with uslcoms production chain shapes (3 reqs/param + hz/10, 1 req/open + hz/10, 1 req/close no pause, 1000 ms) and two extra fix-model phases (B abort-only, C abort+250 ms bound). One bring-up fix: guest file transfer had to switch from python3 (absent) to b64decode; harness compiled and ran correctly on the first build/load.", "attempts": 2, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 420, "guest_dirty": 0, "build_cmd": "cd /usr/src/sys/bus/u4b/serial/sl5425 && make (in-tree kmod build, -Werror clean; see build.sh)", "run_cmd": "kldload /root/df5425/uslcomcfgstall.ko; kldunload uslcomcfgstall; dmesg | grep SL5425 (see run.sh)", "code_hash": "03cbc4fbbc2f29f34f1a72cbf5100455688e383615c420c4df9092c36d574f15", "notes": "Guest cleaned after runs (scratch dirs + /root/df5425 removed, /usr/src uslcom.c md5-verified pristine c0ea096809e44a9fb0dee61f9f005de9, no harness klds loaded). Severity Low, consistent with family calibration (DF-5367 16-18 s Low, DF-5383 16 s Low, DF-5421 14/26 s Low, DF-5424 5.2/8.3-ish s Low); uslcom chains are the shortest in the family (3+1+1) and, unlike uplcom DF-5407 (Medium), attach issues zero EP0 requests so the shared bus explore thread is never pinned at insertion. Pass-2 negative results recorded in VERDICT.md: RCTRL short-response cannot reach USB_ST_TRANSFERRED (usb_transfer.c:2979-2992 short -> error state; xhci.c:713-828 frlengths accounting), divisor guarded by uslcom_pre_param via ucom_param (usb_serial.c:1678-1685), watchdog survives unsetup via the NULL-table protocol (usb_transfer.c:1389-1410) and callout_drain CANCEL semantics (kern_timeout.c:1021-1050), attach-error detach safe via UCOM_FLAG_ATTACHED guard (usb_serial.c:371-372); in-flight-ioctl-vs-detach is DF-5320 territory (usb_serial.c), not re-reported.", "recommended_fix": "Abort uslcom_param()s chain on the first failed vendor request and bound all cfg-path control timeouts (1000 -> 250 ms via USLCOM_CFG_TIMEOUT); full diff in fix.diff", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 1, "fix_verdict": "fix.diff is git-apply-able against sys/ (git apply --check passes on the host repo; patch(1) applied 9/9 hunks cleanly on the guests /usr/src copy). The patched production driver compiles -Werror-clean as the in-tree uslcom.ko kmod on the guest (fix_compile.log RC=0, uslcom.ko 14440 bytes). Harness phase B models mechanism #1 alone (abort on first error, timeout unchanged): closer block 5.1 s -> 3.1 s; phase C adds mechanism #2 (250 ms cfg timeout bound, which is what covers the slow-but-successful evil device): 5.1 s -> 0.9 s. Scope caveat: mechanism + compile level per the family evidence class; end-to-end with a physical crafted CP210x is not possible on this guest.", "fix_evidence": "fix.diff (sha256 30f138c6659249ca47412f57d5c6e5a80a5b79dc293f78cac3803a17d3073009); fix_compile.log; run.log/run.2.log SL5425[B]: closer: unblocked ELAPSED=3149/3121 ms and SL5425[C]: closer: unblocked ELAPSED=899/925 ms vs SL5425[A]: ... 5078/5090 ms; VERDICT.md Fix validation section" }