# DF-5584 VERDICT — REPRODUCED (logic-level; no memory-safety impact in current consumers)

## The defect

`sys/bus/u4b/usb_parse.c:142-151` — `usb_idesc_foreach()` counts alternate
settings of an interface in `ps->iface_index_alt`, a **uint8_t**
(`sys/bus/u4b/usbdi_util.h:37`). When a configuration descriptor contains
**more than 256 interface descriptors sharing one `bInterfaceNumber`**
(fully attacker-chosen bytes from a malicious USB device), the
`ps->iface_index_alt ++` at `usb_parse.c:150` wraps 255 → 0 on the 257th
descriptor, so the 257th+ alternate settings are walked as if they were
alt 0, 1, 2, … again.

DragonFly's tree (imported at FreeBSD r250204, 2013) predates the upstream
fix: FreeBSD commit `6da5df470099fc55f20b03ef364af730e7be4ffe`
("Improve handling of alternate settings in the USB stack.", hselasky,
2020-12-15, PR 251856, submitted by Horse Ma / Dell) adds exactly the
`if (ps->iface_index_alt == 255) continue;` guard. Diff of DF's file vs
FreeBSD head shows this is the **only** functional divergence.

## Reproduction (guest-live, real kernel symbols)

Harness: `altwrap.c` KLD calling the **real** in-kernel
`usb_idesc_foreach()` / `usbd_get_no_alts()` (symbols confirmed in
/boot/kernel/kernel: `ffffffff80a508b0 T usb_idesc_foreach`,
`ffffffff80a50a00 T usbd_get_no_alts`) on crafted blobs:

- EVIL blob: valid 9-byte UDESC_CONFIG header (wTotalLength=2709) +
  300 interface descriptors, all `bInterfaceNumber=0`, unique
  `bAlternateSetting`/subclass tag per descriptor.
- CTRL blob: same with exactly 256.

Observed (run.log, run.2.log — deterministic across 2 loads):

```
EVIL idesc#256: iface_index_alt=255
EVIL idesc#257: iface_index_alt=0     <-- 8-bit WRAP
EVIL walk ended: max_alt=255, WRAP_AT=257
usbd_get_no_alts()=255 while true alt count=300
CTRL walk ended: max_alt=255, WRAP_AT=0   (boundary control clean)
RESULT: WRAP_REPRODUCED
```

Note attempt 1 panicked the guest — **my harness's own bug** (passing
`NULL` as `plen` to `build_blob()` → `*plen = total` NULL write inside
the KLD, before any parser call). Fixed; guest reset; attempt 2 and 3
clean. The parser was never implicated.

## Downstream effect (code-traced; replica demonstrated)

`usb_config_parse()` (sys/bus/u4b/usb_device.c:753-826) consumes the walk:

- usb_device.c:775 `if (ips.iface_index_alt == 0) ep_curr = ep_max;` —
  the wrapped 257th descriptor is treated as a new base setting: the
  interface's endpoint slot base is re-derived mid-walk, so the wrapped
  alt's endpoints occupy fresh slots above the interface's real base.
- usb_device.c:760-770 — a full USB_CFG_INIT selecting alt 0
  (`usbd_set_config_index()` → usb_device.c:648) has `do_init == 1` for
  BOTH the true alt-0 descriptor AND the wrapped 257th; last match wins
  `iface->idesc = id` (usb_device.c:782), so the interface's canonical
  descriptor — the one every driver probes against via
  `usbd_get_interface_descriptor()` — becomes the attacker's 257th
  choice (class/subclass/protocol/bNumEndpoints confusion, mismatched
  against the alt the stack actually negotiates).
- The replica of that matching loop over the real walk confirms:
  `do_init matched 2 descriptors; iface->idesc would land on the wrapped
  descriptor (ALIASED)`.
- `usbd_get_no_alts()` (usb_parse.c:267) returns 255 for a true count of
  300, so the SET_INTERFACE validator usb_handle_request.c:193 and the
  ugen ALT_SELECT path (usb_generic.c:644) reason on a count that no
  longer matches the walked reality.

## Why NOT memory corruption (impact ceiling)

All consumer arrays remain bounded regardless of the wrap:

- interfaces: `ps->iface_index >= USB_IFACE_MAX` check at usb_parse.c:156;
  allocation `ifaces_max` from the same walk (usb_device.c:831-841).
- endpoints: `temp >= USB_MAX_EP_UNITS` break at usb_device.c:802;
  allocation `ep_max` from the same deterministic walk
  (usb_device.c:844-856). ALLOC and INIT perform byte-identical walks of
  the same `udev->cdesc` under `enum_lock` (usb_device.c:643-648), so the
  wrap affects both passes symmetrically — indices never exceed the
  allocated counts.
- Every walked descriptor is in-bounds by `usb_desc_foreach()`'s own
  checks (usb_parse.c:89-99), and `cdesc->wTotalLength` is forced to the
  allocation size at fetch (usb_request.c:1366-1376).

Conclusion: attacker-triggerable **correctness/invariant break with
driver-confusion potential** (and a divergence from a validated upstream
security fix), but no OOB write/read, UAF, or reachable panic was
demonstrable from it in this tree. Escalation to uid0: not applicable
(no corruption primitive).

## Fix

`fix.diff` in this directory: byte-for-byte port of upstream FreeBSD
6da5df47. With the fix, the 257th+ same-numbered descriptor is skipped
(`continue`) and the walk terminates at the 256th — the CTRL-blob
behavior. Kernel-rebuild validation was not performed (per audit policy,
rebuild validation is reserved for memory-corruption findings; this is a
Low-severity logic/hardening finding and the hunk is already main-line
validated upstream). fix_status: not_testable.

## Guest

DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
(X86_64_GENERIC), kernel built from this tree. Guest reset to
`with-src` snapshot after the run.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.