{
  "finding_id": "DF-5516",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Mechanism-level reproduction with the production block verbatim (DF-5488/DF-5505 evidence class): ubser.c:242-262 -- the GET_NUMSER block of ubser_attach, sed-extracted unmodified from the md5-gated guest tree -- runs inside the simulated attach with only the EP0 sink modeled. ubser_probe (ubser.c:215-217) hands attach to any device whose firmware says manufacturer=BWCT with a vendor-specific interface, and the FIRST bus transaction is the synchronous GET_NUMSER with USB_DEFAULT_TIMEOUT=5000 ms (usbdi.h:87) on the per-bus USB explore thread. Measured (hz=100): a silent evil adapter pinned the (simulated) explore thread 4916/4917 ms per insertion before the verbatim error path aborted attach (failed to get number of serial ports: USB_ERR_TIMEOUT via the real usbd_errstr, verbatim goto detach at ubser.c:257); a slow-answer evil adapter made the request SUCCEED at 4900 ms and attach CONTINUE (verbatim found 4 serials) while still pinning 4812/4807 ms -- no error visible anywhere. Every other device on that bus waits out the pin (family mechanism). fix.diff (ubser.c:251: USB_DEFAULT_TIMEOUT -> 1000) applied on the guest, block re-extracted (+2-line shift), harness rebuilt and re-run: 1009 ms fail-fast (891 ms slow-answer) -- pin GONE; tree restored md5-verified.",
  "exploit_chain": "attacker physically inserts an evil USB adapter presenting manufacturer string BWCT + bInterfaceClass 0xff + bInterfaceSubClass 0x00 -> uhub hands it to ubser_attach on the per-bus USB explore thread -> the device NAKs (or slowly answers) the VENDOR_GET_NUMSER data stage -> the synchronous 5 s-timeout request pins bus-wide device enumeration ~5 s per insertion (or ~4.9 s with every request succeeding); repeatable at will by re-insertion",
  "evidence": "run.log/run.2.log: UB5516[A]: explore-thread occupancy 4916/4917 ms; attach ABORT via verbatim `goto detach and UB5516[B]: ... 4812/4807 ms; attach CONTINUES with the request succeeding; run.fixed.log: occupancy 1009 ms (fix validated); build.log: verbatim extraction echoed + -Werror-clean build",
  "kernel_refs": [
    "sys/bus/u4b/serial/ubser.c:206-221",
    "sys/bus/u4b/serial/ubser.c:242-262",
    "sys/bus/u4b/serial/ubser.c:249-251",
    "sys/bus/u4b/usbdi.h:87",
    "sys/bus/u4b/usbdi.h:508-510"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch on the DF-5488/DF-5505 verbatim-extraction pattern. Bring-up fixes: (1) the harness must MODULE_DEPEND on ucom as well (ubser.cs ubser_detach references ucom_detach, unresolved at kldload without it); (2) the verbatim blocks `goto detach (ubser.c:257) needs a local label standing in for ubser.c:296; (3) build.shs md5 gate must be bypassed (documented) for the fixed build, whose block shifts to lines 244-264.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 800,
  "guest_dirty": 0,
  "build_cmd": "sh /root/df5516/src/build.sh (verbatim extraction + in-tree kmod at /usr/src/sys/bus/u4b/serial/ub5516, -Werror clean)",
  "run_cmd": "sh /root/df5516/src/run.sh (kldload /root/df5516/ub5516attach.ko; kldunload; dmesg | grep UB5516)",
  "code_hash": "c9a5debd8981c8b5d64234651a133f63e0c167b5c805e17695624d9f868e9deb",
  "notes": "Guest left pristine (ubser.c md5 restored, harness dirs removed, modules unloaded). Severity Low per family calibration: family-minimum single attach request (~5 s), availability-only impact (ucycom 1x5 s = DF-5505 Low; uipaq 12.8 s = DF-5359 Low; uplcom ~70 s = DF-5407 Medium).",
  "recommended_fix": "Bound the enumeration-time port-count read: 1000 ms instead of USB_DEFAULT_TIMEOUT at ubser.c:251 (full diff in fix.diff; validated: 4916 ms -> 1009 ms).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 1,
  "fix_verdict": "fix.diff applied to the guests /usr/src ubser.c (guest patch(1), hunk @246 offset -1); the block re-extracted from the patched tree (now 244-264) and the same harness rebuilt -Werror-clean and re-run: silent-device occupancy 1009 ms fail-fast vs 4916 ms baseline (slow-answer 891 ms vs 4812 ms) -- the enumeration pin is gone and a live adapter still answers a port-count read in milliseconds. git apply --check passes on the audited repo; guest tree restored and md5-verified.",
  "fix_evidence": "fix.diff; fix_build.log (RC=0); run.fixed.log (UB5516[A]: explore-thread occupancy 1009 ms, UB5516[B]: ... 891 ms); VERDICT.md Fix validation section"
}