{
  "finding_id": "DF-5488",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED with the production code VERBATIM (DF-5407 evidence class): uvisor_init() is sed/awk-extracted unchanged from the guests clean tree (extraction sha256s recorded and re-verified; guest tree == audited tree, uvisor.c sha256 b742032f...) and only its EP0 entry point (usbd_do_request_flags, to which usbd_do_request macro-expands, usbdi.h:511-512) is re-targeted to an evil-device model that NAKs ~4.9 s then answers (USB-legal worst case: the chain continues). Phase A per-insertion explore-thread occupancy: VISOR 4796/4802 ms (1 x GET_CONNECTION_INFORMATION, uvisor.c:382-389), PALM4 4794/4803 ms (1 x GET_PALM_INFORMATION, uvisor.c:434-442), PALM35 9591/9609 ms (UR_GET_CONFIG + UR_GET_INTERFACE, uvisor.c:476-496) -- all at the 5000 ms USB_DEFAULT_TIMEOUT (usbdi.h:87) with each request serializing behind the per-device enum lock (usb_request.c:467). The EP0 trace (0xc2/0x03/len18, 0xc2/0x04/len68, 0x80/0x08, 0x80/0x0a) matches production exactly, and the PALM4 run shows device-supplied endpoint bytes flowing through the verbatim code into config[].endpoint. Fix mechanism (UVISOR_INIT_TIMEOUT 250 ms bound at all four call sites): all variants collapse to ~250 ms with USB_ERR_TIMEOUT and a clean chain abort; fully patched production uvisor.ko compiled -Werror-clean RC=0.",
  "exploit_chain": "Evil USB adapter (Facedacer/gadget) presenting a VID:PID from uvisor_devs[] (uvisor.c:248-278: HANDSPRING VISOR/Treo, PALM m*/Tungsten/Zire, SONY CLIE_35, etc.) -> uvisor_attach() runs uvisor_init() on the per-bus USB explore thread -> the adapter NAKs each control data stage for just-under the 5 s timeout (or never answers) -> bus-wide device enumeration (explore/insert/remove events) is pinned ~5 s per request, up to ~10 s for a CLIE_35-VID:PID device, per insertion; repeatable by re-plugging.",
  "evidence": "run.log/run.2.log: HX5488: PALM35 (Sony Clie 3.5): uvisor_init() DONE err=USB_ERR_NORMAL_COMPLETION ELAPSED=9591/9609 ms, VISOR ... 4796/4802 ms, PALM4 ... 4794/4803 ms; full per-request EP0 trace with bmRequestType/bRequest/wLength matching uvisor.c production call sites; phase-B fixed lines ~250 ms err=USB_ERR_TIMEOUT; build.log: verbatim-extraction sha256s + -Werror kmod build; fix_compile.log: patched production uvisor.ko RC=0.",
  "kernel_refs": [
    "sys/bus/u4b/serial/uvisor.c:302-354",
    "sys/bus/u4b/serial/uvisor.c:370-517",
    "sys/bus/u4b/serial/uvisor.c:382-389",
    "sys/bus/u4b/serial/uvisor.c:434-442",
    "sys/bus/u4b/serial/uvisor.c:476-496",
    "sys/bus/u4b/serial/uvisor.c:248-278",
    "sys/bus/u4b/usbdi.h:87",
    "sys/bus/u4b/usb_request.c:642-644",
    "sys/bus/u4b/usb_request.c:467"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch on the DF-5407 verbatim-extraction pattern. Bring-up fixes: (1) USB_ERR_OK -> USB_ERR_NORMAL_COMPLETION (DF u4b enum name); (2) missing uv_init_fixed.h include; (3) usb_process.h/condvar.h/stdint.h include order; (4) a */ sequence inside my own header comment (the text Treo/Palm m*/Clie) terminated the C comment and broke the parse -- reworded; all documented in build.log history.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "sh /root/df5488/build.sh (verbatim production extraction -> in-tree kmod build at /usr/src/sys/bus/u4b/serial/hx5488, -Werror clean; patch -p5 of fix.diff onto a scratch copy -> phase-B extraction)",
  "run_cmd": "kldload /root/df5488/uvisorstall.ko; kldunload uvisorstall; dmesg | grep HX5488 (see run.sh)",
  "code_hash": "0d22568812375f52a37e25ef0a60dc1e5e0807f9355dfeae3b7a8517ea11f978",
  "notes": "Guest cleaned after runs (harness dirs + scratch removed, uvisor.c md5 unchanged 28d0d390d06dd00f9dbfc03106b453a7). Severity Low, consistent with family (DF-5359 ~12.8 s = Low; DF-5407 ~70 s = Medium): bounded ~5-10 s per insertion, requires an evil Visor-family adapter. Negative results in VERDICT.md: PALM4 actlen>=12 check correctly covers consumed offsets 1/8/9; endpoint nibbles only feed validated usbd_transfer_setup matching. fix.diff git-apply --check passes against the host repo tree.",
  "recommended_fix": "Bound the attach-path control-request timeout to 250 ms (UVISOR_INIT_TIMEOUT) at all four uvisor_init() call sites (full diff in fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff applied to a scratch copy of the guests /usr/src uvisor.c: the patched function re-extracted verbatim (renamed) runs at 250/265, 259/261, 249/272 ms with USB_ERR_TIMEOUT aborts (vs 4.8-9.6 s baseline), and the fully patched production uvisor.ko compiled -Werror-clean RC=0 (fix_compile.log). The multi-second explore-thread occupancy is GONE under the fix.",
  "fix_evidence": "fix.diff (git apply --check clean on host; patch -p5 clean on guest); run.log/run.2.log phase-B lines; fix_compile.log (RC=0); VERDICT.md Fix validation."
}