# DF-5652 — VERDICT

**Finding:** `elcr_read_trigger()` / `elcr_write_trigger()` validate the
caller-supplied irq only with `KASSERT(irq < ISA_IRQ_CNT)` —
`sys/platform/pc64/icu/elcr.c:89`, `elcr.c:106`.

**Verdict: REPRODUCED (live), impact none for an unprivileged attacker —
defense-in-depth gap closing the family perimeter (DF-5616/5464/5465
class). Severity Info.**

## What was proven live (X86_64_GENERIC, INVARIANTS kernel, i440fx)

1. **No lower bound, even under INVARIANTS.** `KASSERT(irq <
   ISA_IRQ_CNT)` is a strictly-less-than check on a signed int: `irq=-1`
   passes. `elcr_read_trigger(-1)` and `elcr_read_trigger(-22)` returned
   normally (`run.log` E1). No panic occurred — the negative irq flowed
   straight into `elcr_status & (1 << irq)` (elcr.c:57, elcr.c:90).

2. **The UB shift aliases a real bit — ALIAS-PROVEN.** x86 `shl` takes
   the count mod 32, so `1 << -22` materializes as `1 << 10`.
   `elcr_read_trigger(-22)` returned the same value as
   `elcr_read_trigger(10)` (both `L`, since this rig's ELCR is 0x0c00 =
   irq10/11 level). The negative irq read/writes a *real* ISA IRQ's
   trigger bit.

3. **A negative irq PROGRAMS LIVE HARDWARE.** `elcr_write_trigger(-27,
   INTR_TRIGGER_LEVEL)` — `-27 < 16` passes the assert — set shadow bit 5
   (`new_status = elcr_status | (1 << -27)` → `1 << 5`) and wrote port
   0x4d0: `0x00 -> 0x20 (bit5 SET)` (run.log E2). The kernel then
   believes irq5 is edge (stale intent) while hardware is level — or
   vice versa after a further in-range write. State restored exactly
   (`ok=YES`).

4. **The upper bound is a debug assert, not a guard.** Loading
   `elcrboom.ko` on this INVARIANTS guest panics at exactly
   `elcr.c:106`: `panic: elcr_write_trigger: invalid IRQ 16`, trace
   `elcr_write_trigger+0x8c <- elcrboom_modevent` (panic.txt). On a
   production (non-INVARIANTS) kernel `sys/sys/systm.h:117` compiles
   the KASSERT to `do { } while (0)`: the same call silently executes
   `elcr_status |= 1 << 16` — shadow corruption past the 16-bit
   register domain, no error, no port protection (the `outb` at
   elcr.c:115 truncates to 8 bits, so bits 16-31 poison only the
   shadow; they resurface in `elcr_resume()`'s byte writes).

## Reachability (why Info)

* In-tree callers are bounded: `icu_abi_initmap()` loops i=0..15
  (icu_abi.c:342-344); `icu_abi_legacy_intr_config()` checks
  `KKASSERT(irq >= 0 && irq < IDT_HWI_VECTORS)` — always compiled in —
  plus `KKASSERT(im_type == ICU_IMT_LEGACY)` which pins irq to 0..15 in
  practice (icu_abi.c:373-376). No unprivileged-user path exists: the
  config chain is `machintr_legacy_intr_config` <- nexus_config_intr
  (BUS_CONFIG_INTR, driver probe) / acpi_fadt SCI setup / pci tunable —
  all kernel/boot/root reach.
* The realistic in-tree route for a wild irq is a *driver bug* of the
  DF-5465 class (`icu_abi_legacy_intr_config` KKASSERT-only bounds on a
  production kernel) — where elcr is the final sink. Sibling finding
  DF-5616 (icu.c:167, same signed-lower-bound gap feeding the 8259 IMR)
  closes the same perimeter on the mask side.
* No memory unsafety: no array indexing anywhere in elcr.c — the blast
  radius is the 16-bit ELCR register domain and the 32-bit shadow.

## Harness

`elcrx.c` (shared 3-finding harness; E0/E1/E2 phases here) and
`elcrboom.c` (upper-bound probe, run last). Build clean with `-Werror`
(build.log). v1 of the harness wedged the guest with a spin-barrier
starvation bug (documented in `wedge_v1.log`, poc_changes) — not a
finding; v2 removed the barrier. Every destructive phase restores state
(`ok=YES`, `E9: coherent=YES ... guest HEALTHY`); the boom panic is
followed by `vm.sh reset with-src` (guest returned clean).

## Fix

Runtime signed bounds in both functions (fix.diff): the KASSERTs gain
`irq >= 0 &&`, and a real `if (irq < 0 || irq >= ISA_IRQ_CNT)` guard
returns a safe value before any shift or port write — the write path
must never touch 0x4d0/0x4d1 with an out-of-contract irq. Behavioral
delta vs the live P-runs: negative/OOB irqs return EDGE / no-op instead
of aliasing a real bit (E2) or corrupting the shadow (boom).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.