{
  "finding_id": "DF-5584",
  "status": "reproduced",
  "reproduced": true,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced guest-live against the real in-kernel usb_idesc_foreach(): a crafted configuration descriptor with 257+ interface descriptors sharing one bInterfaceNumber wraps the uint8_t ps->iface_index_alt counter 255->0 at walk position 257 (dmesg WRAP_AT=257; 256-alt control clean), because DragonFlys r250204-era import predates upstream FreeBSD commit 6da5df47 (PR 251856) which caps alt settings at 256. Downstream (code-traced + replica over the real walk): usb_config_parses full INIT selecting alt 0 matches BOTH the true alt-0 and the wrapped 257th descriptor, so iface->idesc lands on the attackers 257th descriptor (driver probe/endpoint confusion), the ep_curr slot base resets mid-walk, and usbd_get_no_alts() reports 255 for a true 300 so the SET_INTERFACE validator reasons on a stale count. Impact ceiling is logic confusion only: every consumer array stays bounded (USB_IFACE_MAX=32 at usb_parse.c:156, USB_MAX_EP_UNITS=32 at usb_device.c:802, ALLOC/INIT walk deterministically and identically under enum_lock), and wTotalLength is forced to the allocation size at fetch (usb_request.c:1376) - no OOB/UAF/panic primitive was demonstrable, so no uid0 chain exists for this bug. Classification: attacker-triggerable invariant break / missing validated upstream security fix; Low severity hardening, not memory corruption.",
  "exploit_chain": "",
  "evidence": "run.log / run.2.log: EVIL idesc#256: iface_index_alt=255 then EVIL idesc#257: iface_index_alt=0 and RESULT: WRAP_REPRODUCED (evil wrap at idesc#257; 256-alt control clean); usbd_get_no_alts()=255 while true alt count=300; replica usb_config_parse(INIT, alt=0): do_init matched 2 descriptors; iface->idesc ... ALIASED onto wrapped descriptor. build.log: clean -Werror KLD build; nm confirms ffffffff80a508b0 T usb_idesc_foreach in /boot/kernel/kernel (env.txt). VERDICT.md: full narrative incl. attempt-1 harness NULL-write panic (own bug, guest reset). fix.diff: port of upstream FreeBSD 6da5df47.",
  "kernel_refs": [
    "sys/bus/u4b/usb_parse.c:150",
    "sys/bus/u4b/usb_parse.c:135",
    "sys/bus/u4b/usbdi_util.h:37",
    "sys/bus/u4b/usb_device.c:775",
    "sys/bus/u4b/usb_device.c:760",
    "sys/bus/u4b/usb_device.c:782",
    "sys/bus/u4b/usb_handle_request.c:193",
    "sys/bus/u4b/usb_request.c:1376"
  ],
  "poc_changes": "Seed-free (new harness). Fixes vs first draft: (1) include <bus/u4b/usbdi.h> before usbdi_util.h (usb_parse.cs own order); (2) add <sys/bus.h> + SRCS device_if.h bus_if.h for device_t; (3) SI_SUB_DRIVERS not SI_SUB_DRIVER; (4) opt_usb.h copied from /usr/obj/usr/src/sys/X86_64_GENERIC (module include quirk); (5) build in-place without obj dir so -I. finds opt_usb.h; (6) feed all guest scripts to /bin/sh via stdin (root login shell is csh); (7) attempt-1 panic was my harness passing NULL plen to build_blob -> *plen NULL write; fixed, guest reset with-src, re-run clean.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 600,
  "guest_dirty": 0,
  "build_cmd": "ssh dfbsd /bin/sh: cd /root/df5584 && make   (altwrap.c + Makefile + opt_usb.h from kernel objdir)",
  "run_cmd": "kldload /root/df5584/altwrap.ko && dmesg | grep ALTWRAP && kldunload altwrap",
  "code_hash": "a9457e88b9ef0f8f0b9f4f70d8fa0b86bedc1f28d099b8ed0636b1d22c1d6415",
  "notes": "Deterministic across 2 KLD loads (run.log, run.2.log). Guest reset to with-src snapshot after the run (the attempt-1 panic was the harnesss own NULL write, before any parser call - serial log in boot.log showed build_blob+0x5d). Diff vs FreeBSD head usb_parse.c shows this guard is the ONLY functional divergence of the file. Negative results recorded in the pass-2 audit: usb_desc_foreach walk invariants hold (bLength==0 self-terminates via desc[0]<3 at usb_parse.c:98; forward-only >=3 advance; desc+desc[0]<=end at :93-95 bounds all descriptor field reads); endpoint/iface array growth capped and ALLOC/INIT-symmetric; no usbd_parse_descriptors exists in DF; device-mode SET_INTERFACE bounded at usb_handle_request.c:193,240; DF-5406 hid Push/Pop shape has no analog here.",
  "recommended_fix": "Port upstream FreeBSD 6da5df47: in usb_idesc_foreach(), skip further same-bInterfaceNumber descriptors once ps->iface_index_alt == 255 (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": null,
  "fix_verdict": "fix.diff is a byte-for-byte port of upstream FreeBSD 6da5df47 (PR 251856), already validated in FreeBSD main+stable; per audit policy the single-fix kernel rebuild is reserved for memory-corruption findings, and this one is a Low-severity logic/hardening defect with no corruption primitive, so the patched-kernel run was not performed. Baseline (unpatched) behavior reproduced twice as WRAP_AT=257; with the upstream hunk the walk provably terminates at the 256th descriptor (the CTRL-blob behavior).",
  "fix_evidence": "fix.diff (ported upstream hunk); run.log baseline WRAP_AT=257; CTRL 256-alt clean walk demonstrates the post-fix termination shape."
}