# DF-5453 — kue(4) attach-failure detach on never-attached usb_ether → kernel panic

**File:** `sys/bus/u4b/net/if_kue.c` (Kawasaki KL5KUSB101B USB ethernet, uether core)
**Class:** DF-5334 goto-detach family (7th sibling: cdce/aue/axge/urndis/mos/udav → kue)
**Severity:** Medium — evil-USB deterministic kernel panic (fixed-address NULL deref), physical/VM-USB access required.

## Build (in guest)

```
cd /root/df5453
make -m /usr/src/share/mk
```

## Run (baseline — stock kernel/modules)

```
kldload -v ./kue_poc.ko
```

## Expected (baseline)

Three `kue_poc:` marker lines on the console, then

```
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x0
current process		= 1040 (kldload)
Stopped at      lockmgr_exclusive+0x5d: orl     (%r14),%esi
```

guest dead in DDB (`panic.txt`).

## Expected (with fix.diff modules)

```
kue_poc: SURVIVED uether_ifdetach() (UNEXPECTED — guard present?)
KLDLOAD_RC=0
```

clean `kldunload`, `dmesg | grep -c 'Fatal trap'` = 0; the fixed `if_kue.ko`
driver module also loads/unloads cleanly (`run.log`).

## What the harness does

`kue_attach_poc.c` is a KLD that reconstructs the exact post-`usbd_transfer_setup()`
-failure state of `kue_attach()` (if_kue.c:481-486): a zeroed `struct kue_softc`
whose only initialized field is `sc_lock` (if_kue.c:478) — `ue_lock/ue_dev/ue_udev/
ue_methods/ue_tq` are all still NULL because they are assigned only at
if_kue.c:495-499. It then replays `kue_detach()` verbatim, calling the
**production** `usbd_transfer_unsetup()` and `uether_ifdetach()` (exported by
`uether.ko`): `uether_ifdetach()` no-ops through `usb_proc_drain()` and hits
`UE_LOCK(ue)` = `lockmgr(NULL, LK_EXCLUSIVE)` → Fatal trap 12, VA 0x0.

The real-world trigger is fully device-controlled: an evil USB adapter
presenting one of the 33 `kue_devs[]` VID:PID pairs (e.g. KLSI DUH3E10BT
0x05e6:0x0008) at config 0 / iface 0 but without the expected bulk-in/out
endpoints makes `usbd_transfer_setup()` fail with `USB_ERR_NO_PIPE`
(usb_transfer.c:1030-1053) at plug-in time.

## Fix validation

`fix.diff` (git-apply-able against clean `sys/`, verified with
`git apply --check`): (a) class-wide `uether_ifdetach()` early-return when
`ue->ue_lock == NULL`, (b) `kue_attach()` routes all three pre-attach failure
branches to a `detach_usb` label doing only `usbd_transfer_unsetup()` +
`kfree(sc->sc_mcfilters)` + `lockuninit()`. Applied in-guest to `/usr/src`,
`uether.ko` and `if_kue.ko` rebuilt `-Werror` clean, patched `uether.ko`
installed into `/boot/kernel`, guest rebooted, identical harness re-run →
SURVIVED, RC=0, 0 fatal traps.