{ "finding_id": "DF-5585", "status": "untested", "reproduced": false, "impact": "none", "confidence": "certain", "verdict": "Latent memory-corruption landmines in the quirk-apply loop, machine-proven in a verbatim rig but NOT reachable in the shipped kernel (rig status honestly untested at the kernel level: the guest has no PCMCIA bridge AND the path is dead code today). Facet 1 (write-after-free): the fast path if (pf_last == q->pf) at pccard_cis_quirks.c:263-270 dereferences pf assuming it is the live copy of template pf_last, but the cfe-allocation error path at :280-285 kfrees the just-allocated pf (line 282) without invalidating that tracking state; any later matching quirk re-using the pf_last template then runs STAILQ_INSERT_TAIL(&pf->cfe_head,...) into freed memory -- 8-byte pointer writes at offsetof(pccard_function, cfe_head)=40 and +48. Rig repeat scenario detects exactly this (FREED-WRITE, first diff +41, 5 bytes) while the shipped-table-shape control shippedfail stays CLEAN. Facet 2 (NULL-page write): the wipe loop :248-257 always exits with pf==NULL (loop variable), so a table entry with q->pf==NULL matches pf_last==NULL==q->pf and line 270 computes &((struct pccard_function*)NULL)->cfe_head = 0x28, writing through stqh_last at 0x30 -- rig nulltemplate child dies on SIGSEGV at exactly that address; kernel equivalent is a deterministic NULL-page write panic. UNREACHABILITY PROOF (why impact=none): the match semantics at :201-216 constrain every card identity to a match set of <=2 entries (three 3COM (manufacturer,product) pairs, each a func0/func1 pair with distinct templates; SVEC vs NDC cis1_info string sets are disjoint -- pccarddevs:327,332), so consecutive matches never share a template, the fast path is dead code for the shipped table, and a cfe-alloc failure can only strike the final matching entry -- machine-checked by the rig matchmatrix over all 6 card identities. One quirk-table edit (a repeated/alternating template, the exact sharing pattern :179-186 already uses across two product ids) plus one M_NOWAIT failure during card insertion converts facet 1 into kernel heap corruption; physical-card threat model shared with the DF-5355..5364 family. Fix validated in-rig (fixed_repeat/fixed_nulltemplate CLEAN): NULL-guard table entries + reset pf_last on the :281-285 error path (fix.diff). Kernel-rebuild fix validation not performed: no baseline behavior exists to eliminate (bug unreachable in shipped kernel).", "exploit_chain": "", "evidence": "findings/poc/DF-5585/run.log: FREED-WRITE[repeat]: block ... (kmalloc #9) modified: first diff at +41 (write into the pf kfreed at pccard_cis_quirks.c:282); child died on SIGSEGV writing near address 0x28/0x30 (NULL-template facet); RESULT: DF-5585 matchmatrix: shipped table fast-path reachable by ANY card identity: NO; fixed_* scenarios CLEAN; fidelity.diff (rig function bodies identical to sys/ apart from 3 documented shims); VERDICT.md for the full narrative", "kernel_refs": [ "sys/bus/pccard/pccard_cis_quirks.c:263", "sys/bus/pccard/pccard_cis_quirks.c:270", "sys/bus/pccard/pccard_cis_quirks.c:280", "sys/bus/pccard/pccard_cis_quirks.c:282", "sys/bus/pccard/pccard_cis_quirks.c:248", "sys/bus/pccard/pccard_cis_quirks.c:201", "sys/bus/pccard/pccard_cis_quirks.c:178", "sys/bus/pccard/pccardvar.h:128" ], "poc_changes": "Authored from scratch (no seed): verbatim copies of pccard_cis_quirk_match() and pccard_check_cis_quirks() with 3 documented shim substitutions (device_t->sc parameter, dropped PCCARD_SOFTC line, qlog in the dead bootverbose block); failpoint allocator with freed-block snapshot audit (kernel kfree does not scrub); fixed variant carries only the two fix.diff guard lines. One mid-run correction: initial nulltemplate framing claimed the wipe leaves pf dangling -- wrong, the wipe loop variable exits NULL, making the facet a NULL-page write (rig child SIGSEGV at 0x28/0x30), which the final version reports gracefully via fork.", "attempts": 3, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 6, "guest_dirty": 0, "build_cmd": "cc -O2 -Wall -o poc_quirkfastpath poc_quirkfastpath.c", "run_cmd": "./poc_quirkfastpath all", "code_hash": "1763ed328231507dbc2da19347773dfff04acfb97e774997386b9949175d21db", "notes": "Evidence class: deterministic userland rig of the verbatim kernel functions (pccard_cis family pattern, cf. DF-5360..5364) + code-reading; guest has no PCMCIA hardware (env.txt). Negative results of the pass-2 audit of this file are recorded in the result block (no double-free interplay: cfe entries are struct-copied at pccard_cis.c:913, never aliased across chains; template positional initializers match pccardvar.h:87-160 field order with num_iospace=1<=4, num_memspace=0<=2; quirk-side strcmp strings non-NULL per pccarddevs:327,332, card side NULL-guarded at :210/:212 and NUL-terminated by construction pccard_cis.c:748-756; wipe-orphan-on-re-entry is DF-5356s class, not re-filed).", "recommended_fix": "fix.diff: skip malformed quirk entries (q->pf/q->cfe NULL) and reset pf_last=NULL on the :281-285 cfe-allocation error path so the fast-path invariant always holds", "fix_status": "not_testable", "fix_baseline_reproduced": false, "fix_patched_reproduced": false, "fix_verdict": "Kernel-rebuild fix validation not applicable: the bug is unreachable in the shipped kernel (fast path is dead code for the shipped table -- matchmatrix), so no baseline kernel behavior exists to reproduce and eliminate. The fix was validated at rig level instead: fixed_repeat and fixed_nulltemplate (verbatim loop + fix.diffs two guards) run the same failing scenarios with zero freed-memory writes and no fault (run.log).", "fix_evidence": "findings/poc/DF-5585/run.log (fixed_repeat / fixed_nulltemplate scenarios: freed-memory audit ... CLEAN); findings/poc/DF-5585/fix.diff" }