{ "finding_id": "DF-5453", "status": "reproduced", "reproduced": true, "impact": "panic", "confidence": "certain", "verdict": "Deterministic kernel panic at USB device plug-in: kue_attach()s usbd_transfer_setup() failure branch (if_kue.c:483-486 allocating USB transfers failed) goto-jumps into the full kue_detach() (if_kue.c:508-510) while the embedded usb_ether is still entirely zeroed (ue_lock/ue_dev/ue_udev/ue_methods/ue_tq are assigned only at if_kue.c:495-499, AFTER the failing call). uether_ifdetach() then lockmgr()s through the NULL ue_lock (Fatal trap 12, fault VA 0x0, Stopped at lockmgr_exclusive+0x5d) - the 7th instance of the DF-5334 (if_cdce) class proven this pass after cdce/aue/axge/urndis/mos/udav: usb_proc_drain() no-ops on the zeroed ue_tq and the ifp!=NULL guard is dead code because uether_getifp() returns the embedded arpcom ifnet. The trigger is fully device-controlled: any evil USB adapter presenting one of the 33 kue_devs[] VID:PID pairs (e.g. KLSI DUH3E10BT 0x05e6:0x0008 or 3Com 3C460 0x04cf:0x7992) at config 0/iface 0 without the expected bulk-in/out endpoints fails the transfer setup with USB_ERR_NO_PIPE (usb_transfer.c:1030-1053). The third failure branch (uether_ifattach error, only on usb_proc_create ENOMEM) additionally runs ether_ifdetach() on a never-if_attach()ed ifnet -> ifindex2ifnet[0] nulling + global ifnet list corruption (latent, same as siblings); the second branch (kmalloc M_WAITOK NULL check) is dead code on DragonFly. Verified with a KLD harness replaying kue_detach() verbatim (its two production calls in order) on the exact branch-1 state, using production usbd_transfer_unsetup()+uether_ifdetach(): baseline on pristine with-src guest with stock uether.ko -> Fatal trap 12 VA 0x0, guest dead in DDB (panic.txt); with fix.diff ((a) uether_ifdetach early-return on NULL ue_lock + (b) kue_attach detach_usb label doing only unsetup+kfree+lockuninit) both modules rebuilt -Werror clean and the identical harness run SURVIVED with KLDLOAD_RC=0, 0 Fatal traps, clean unload, and the patched if_kue.ko driver loads/unloads clean (run.log). Not memory corruption with attacker-controlled data: fixed-address NULL deref at plug time; impact is panic/DoS from physical/VM USB access, same tier as the six siblings (Medium).", "exploit_chain": "", "evidence": "panic.txt (baseline serial: 3 kue_poc markers -> Fatal trap 12, fault virtual address = 0x0, current process 1040 (kldload), Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> prompt); run.log (patched run: SURVIVED marker, KLDLOAD_RC=0, UNLOAD_OK, FATAL_COUNT=0, KUE_DRIVER_LOAD_OK/UNLOAD_OK); build.log + fix_build.log (uether.ko + if_kue.ko -Werror clean); env.txt (guest uname/dmesg/kldstat); fix.diff (git-apply-able against clean sys/, git apply --check OK)", "kernel_refs": [ "sys/bus/u4b/net/if_kue.c:481-486", "sys/bus/u4b/net/if_kue.c:488-493", "sys/bus/u4b/net/if_kue.c:495-499", "sys/bus/u4b/net/if_kue.c:501-510", "sys/bus/u4b/net/if_kue.c:513-525", "sys/bus/u4b/net/usb_ethernet.c:61", "sys/bus/u4b/net/usb_ethernet.c:133-137", "sys/bus/u4b/net/usb_ethernet.c:267-305", "sys/bus/u4b/usb_process.c:397-410", "sys/bus/u4b/usb_transfer.c:1030-1053" ], "poc_changes": "No seeded PoC existed. Wrote kue_attach_poc.c from scratch (mirroring the DF-5384 aue harness of the same class): KLD harness (MODULE_DEPEND uether) that kmallocs a zeroed struct kue_softc, lockinit()s sc->sc_lock exactly as if_kue.c:478 does (the only softc initialisation before the failing usbd_transfer_setup() at :481), prints the zeroed ue state, then replays kue_detach() verbatim: production usbd_transfer_unsetup(sc->sc_xfer, KUE_N_TRANSFER) (if_kue.c:519) + production uether_ifdetach(&sc->sc_ue) (if_kue.c:520). Physical KL5KUSB101B emulation is infeasible in QEMU (no usbredir gadget for this harness class); static kue_attach/kue_detach cannot be linked against, so the branch-1 state + exact call-sequence replay is the strongest runnable evidence and uses only production code after the goto.", "attempts": 3, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64", "runtime_sec": 560, "guest_dirty": 1, "build_cmd": "in-guest: mkdir -p /root/df5453 && cd /root/df5453 && make -m /usr/src/share/mk (harness; fix validation additionally: cd /usr/src/sys/bus/u4b/net/uether && make; cd ../kue && make; cp uether.ko /boot/kernel/)", "run_cmd": "in-guest: kldload -v /root/df5453/kue_poc.ko # baseline: Fatal trap 12 VA 0x0 (stock uether.ko auto-loaded); patched: SURVIVED + RC=0", "code_hash": "6c2cef3fabce68cf26cf55d4be39832e78f6f328a6157a91081e4269f11efb02", "notes": "Pass-2 audit of if_kue.c: everything else on the USB-net checklist proven BOUNDED - rx: frames < 2+14 rejected (if_kue.c:547), device 16-bit length prefix clamped by min(actlen,len) (if_kue.c:555) with actlen<=bufsize MCLBYTES+2, and uether_rxbuf (usb_ethernet.c:589) rejects len>MCLBYTES-ETHER_ALIGN copying at cluster offset ETHER_ALIGN -> exact fit, no OOB (unlike urndis DF-5396, kue is protected by the core check; uether_rxbuf return ignored = accounting nit); tx: pkthdr.len clamped to MCLBYTES (if_kue.c:603-604, only lowered), total_len<=MCLBYTES+66 within bufsize MCLBYTES+2+64 (if_kue.c:180,606); no MII in kue (methods at if_kue.c:220-227 set none), kue_setword/kue_ctl fixed-size stack requests; sc_desc feeds ue_eaddr/MCFILTCNT only - the MCFILTCNT-before-descriptor-read overflow is the known DF-1075/DF-2340 (not re-reported); ignored kue_ctl return in kue_attach_post (if_kue.c:439-443) -> zero MAC on failure, robustness nit. Guest reset to with-src after validation.", "recommended_fix": "kue_attach(): route all three pre-attach failures to a detach_usb label doing only usbd_transfer_unsetup()+kfree(sc_mcfilters)+lockuninit(); uether_ifdetach(): early-return when ue->ue_lock==NULL (class-wide, same as DF-5334/DF-5384 fix)", "fix_status": "fixed", "fix_baseline_reproduced": 1, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff applied in-guest to /usr/src (patch(1) Plan A, both files); uether.ko and if_kue.ko rebuilt -Werror clean (fix_build.log); patched uether.ko installed into /boot/kernel; guest rebooted and the IDENTICAL harness re-run: kue_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg|grep -c Fatal trap = 0, kldunload clean, and the patched if_kue.ko driver module loads/unloads clean. Baseline panic record in panic.txt, patched survival in run.log. fix.diff verified git-apply-able against the clean read-only sys/ tree (git apply --check OK).", "fix_evidence": "run.log (SURVIVED marker + KLDLOAD_RC=0 + UNLOAD_OK + FATAL_COUNT=0 + KUE_DRIVER_LOAD_OK); fix_build.log (uether.ko + if_kue.ko -Werror clean); panic.txt (baseline trap on identical input); fix.diff (git apply --check OK on clean tree)" }