# DF-5464 VERDICT — reproduced (OOB write past contract array + panic + livelock), driver-facing MSI ABI, Low severity

## Bottom line

REPRODUCED on the guest, on a kernel built exactly like production
(X86_64_GENERIC minus `options INVARIANTS`; stock GENERIC ships without
INVARIANTS too): `icu_abi_msi_alloc_intern()` (icu_abi.c:452-513)
performs **no runtime validation** of the driver-supplied `count`. A KLD
(the driver-facing ABI, identical in reach to `PCIB_ALLOC_MSI` →
`nexus_alloc_msi` → `MachIntrABI.msi_alloc`, active on ICU-ABI configs
where `lapic_enable && !ioapic_enable`) passing `count=64` gets a clean
success return and **32 kernel words written past the caller's 32-int
contract array** (icu_abi.c:498 `intrs[j] = intr`; the reference caller's
array is the on-stack `int irqs[32]` at sys/bus/pci/pci.c:1952/2072).
`count=-2600000` walks the scan index below the kernel image:
`Fatal trap 12 ... fault virtual address = 0xffffffff7f1bf020` (below
KERNBASE 0xffffffff80200000), `Stopped at icu_abi_msi_alloc_intern+0x5a:
movl (%r13,%rax,1),%edi` — the `im_type` load at icu_abi.c:476.
`count=0` never advances `i` and **live-locks the kernel while holding
icu_irqmap_tok** (icu_abi.c:463/:473): kldload never returned and the
guest then stopped servicing new ssh sessions entirely for minutes
("Connection timed out during banner exchange" on every attempt) — a
system-wide wedge needing a hardware reset. On the INVARIANTS kernel
(stock X86_64_GENERIC) the same trigger panics `panic: invalid count 64`
at the KASSERT (icu_abi.c:460) — the KASSERT is the only guard.

## How it was reproduced (baseline X86_64_NOINV, full logs in run.log)

RUN 1 — safe canary demo (icu_msiabi_probe.ko):

    icu_msiabi_probe: msix_alloc(cpu0) rc=0 irq=16        <- legal path OK
    icu_msiabi_probe: msi_alloc rc=0                      <- count=64 ACCEPTED
    icu_msiabi_probe: zone[0..7] = 128 129 ... 135        <- alloc at i=128
    icu_msiabi_probe: 32/96 canary words past zone[31] overwritten
    icu_msiabi_probe:   zone[32]=160  <-- OOB write past 32-int contract
    icu_msiabi_probe: msi_release(64) done / SAFE PHASE COMPLETE

Guest healthy afterwards — this is a clean OOB-write primitive, not a
blanket failure.

RUN 2 — negative count (icu_msiabi_neg.ko) → panic_neg_count.txt:

    Fatal trap 12: page fault while in kernel mode
    fault virtual address = 0xffffffff7f1bf020  (below KERNBASE)
    Stopped at icu_abi_msi_alloc_intern+0x5a: movl (%r13,%rax,1),%edi

RUN 3 — zero count (icu_msiabi_livelock.ko): kldload never returned
(caller-side timeout expired); afterwards the guest refused all new ssh
sessions (banner timeout) until a QEMU-monitor hardware reset.

ICU-vs-IOAPIC note: unlike the ioapic twin (DF-5351), ICU map rows are
fragmented ([0..15] LEGACY/RESERVED, [96] SYSCALL, next row's head
RESERVED), so count=128 cannot complete a row-crossing window here; the
demonstrated primitives are the contract-array stack smear, the negative
scan walk, and the token-holding livelock.

## Primitive characterization (why Low severity, not higher)

Writes: for each j in [0,count): `intrs[j] = i+j` (semi-controlled small
ints, past the caller's array — kernel stack in the real caller) and
`icu_irqmaps[cpuid][i+j] = {im_type=MSI/MSIX, im_msi_base=i}` (16-byte
strided map corruption). Reach requires a driver calling the ICU MSI ABI
with a bad count — already-privileged code (kldload) or a malicious PCIe
device paired with a driver that forwards the device-advertised MMC
count. No unprivileged entry point exists (no sysctl/ioctl/dev-node
surface in this file). Hence Low severity — but the primitive is real
memory corruption past an attacker-influenced bound plus a trivial
system-wide livelock.

## Fix validation (fix.diff, applied to guest /usr/src, incremental rebuild)

Baseline reproduced → apply fix.diff (runtime count/powerof2 checks
returning EINVAL/early-return in msi_alloc_intern/msi_release_intern)
→ rebuild X86_64_NOINV → reboot → identical PoCs (run_fixed.log):

    probe:     msi_alloc rc=22 (EINVAL), "alloc failed, no canary test",
               legal msix count=1 round trip still OK
    neg:       SURVIVED, rc=22            (was: fatal trap)
    livelock:  returned rc=22             (was: permanent hang + ssh wedge)

Bad behavior gone; no regression on legal allocations.

## What I had to fix vs a naive PoC (poc_changes)

- Same KLD plumbing lessons as DF-5351: in-tree kmod.mk recipe, generated
  device_if.h/bus_if.h, moduledata_t-based DECLARE_MODULE.
- The count=-2600000 value was chosen so the second loop iteration reads
  ~41 MB below icu_irqmaps (0xffffffff81a00420) — below KERNBASE,
  guaranteed unmapped — instead of stepping through mapped BSS first.
- The livelock rig expects the caller side to time out; the guest wedge
  afterwards (all ssh dead) is stronger than predicted and documented.

## Kernel references

- sys/platform/pc64/icu/icu_abi.c:460-461 (KASSERT-only count checks)
- sys/platform/pc64/icu/icu_abi.c:473-507 (scan loop, intrs[j]=intr, msi_setup)
- sys/platform/pc64/icu/icu_abi.c:524-533 (release count check + intrs[i] read)
- sys/sys/systm.h:94-122 (KASSERT/KKASSERT compiled out without INVARIANTS)
- sys/bus/pci/pci.c:1952,2072 (caller's 32-int stack arrays)
- sys/platform/pc64/x86_64/nexus.c:591-596 (nexus_alloc_msi gating)
- sys/config/GENERIC (no INVARIANTS) vs sys/config/X86_64_GENERIC:56

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.