# DF-5465 VERDICT — reproduced (silent OOB RMW write + wild-index panic), driver-facing legacy-config ABI, Low severity

## Bottom line

REPRODUCED on the production-behaviour kernel (X86_64_NOINV; stock
GENERIC equally affected): `icu_abi_legacy_intr_config()`
(icu_abi.c:366-397) validates its driver-supplied `irq` only with
KKASSERTs compiled out of production kernels. A driver calling
`bus_config_intr()` / `MachIntrABI_ICU.legacy_intr_config()`:

- **irq=1000**: silently performs the OOB read-modify-WRITE
  `map->im_flags |= ICU_IMF_CONF` (icu_abi.c:379) and `map->im_trig =
  trig` (:389) at `&icu_irqmaps[0][1000]` (+16000 bytes — another CPU's
  map row), then calls `elcr_write_trigger(1000, ...)`
  (elcr.c:70-92) whose KASSERT is likewise gone (UB `1 << irq` shift +
  outb to the ELCR port) — returns void, no error, guest apparently
  healthy.
- **irq=-100000000**: `Fatal trap 12: page fault while in kernel mode`,
  `fault virtual address = 0xffffffff2238a42c` (= icu_irqmaps base
  0xffffffff81a00420 − 0x5F5E1000 + 0xc — exactly the im_flags field of
  element −100000000), `fault code = supervisor write data`, **
  `Stopped at icu_abi_legacy_intr_config+0x25: orl $0x1,0xc(%rbx)`** —
  the `|=` RMW at icu_abi.c:379 faulting on a wild negative index.

On the INVARIANTS kernel the same call panics at the KKASSERT
(icu_abi.c:373) — either way a driver bug is promoted to a kernel panic;
on production kernels it is first a silent 16-byte-strided OOB write
primitive at a driver-chosen offset.

## How it was reproduced (baseline X86_64_NOINV, run.log / panic_wild_irq.txt)

    icu_legacy_probe: step1 legacy_intr_config(1000, EDGE, HIGH): ...
    icu_legacy_probe: step1 RETURNED WITHOUT ERROR (void) -- OOB write done
    icu_legacy_probe: step2 legacy_intr_config(-100000000, ...): ...
    Fatal trap 12: page fault while in kernel mode
    fault virtual address = 0xffffffff2238a42c
    fault code = supervisor write data, page not present
    Stopped at icu_abi_legacy_intr_config+0x25: orl $0x1,0xc(%rbx)
    db>

The faulting instruction is byte-for-byte the predicted RMW
(`im_flags` at struct offset 0xc of a 16-byte element).

## Primitive characterization

16-byte-strided OOB write at an attacker/driver-chosen index with
partially-fixed contents (`|1` RMW on im_flags; small enum into
im_trig), plus the ELCR shadow/port write with a wild irq. Moderate
indices corrupt other CPUs' map rows silently; wild indices panic. Same
production-no-op-guard class as DF-5352 (ioapic twin); same-class
bullets folded into this finding: `icu_abi_intr_enable/disable/setup/
teardown` KASSERT-only bounds (icu_abi.c:178,:196,:263,:287) and
`icu_abi_msi_map` type/base KASSERTs only (icu_abi.c:628-634, silently
wrong `msi_map(-1,...)` hardware values). Trigger requires a
driver-facing call — already-privileged — hence Low severity.

## Fix validation (fix.diff, applied to guest /usr/src, incremental rebuild)

Identical PoC on the fixed kernel (run_fixed.log):

    step1 RETURNED WITHOUT ERROR   (now rejected at the runtime bounds/
                                   type check BEFORE the write)
    step2 RETURNED WITHOUT PANIC   (was: fatal trap)
    guest healthy afterwards

Bad behavior gone; legal legacy config (irq<16 LEGACY maps) unaffected
(bounds check uses ICU_HWI_VECTORS=16, type check passes for LEGACY).

## Kernel references

- sys/platform/pc64/icu/icu_abi.c:373-376 (KKASSERT-only bounds + type)
- sys/platform/pc64/icu/icu_abi.c:379 (im_flags OOB RMW write — the faulting insn)
- sys/platform/pc64/icu/icu_abi.c:389,396 (im_trig write, elcr_write_trigger)
- sys/platform/pc64/icu/elcr.c:70-92 (KASSERT-only irq guard, 1<<irq UB)
- sys/sys/systm.h:94-122 (asserts compiled out without INVARIANTS)
- sys/sys/machintr.h:103 (bus_config_intr → legacy_intr_config shim)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.