{
  "finding_id": "DF-5664",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "REPRODUCED with a privileged KLD harness on the live guest: sys/bus/u4b/usb_mbuf.c:69 assigns the 64-bit product (block_size + sizeof(struct usb_mbuf)) * nblocks into a usb_size_t (uint32_t) before kmalloc, so any product >= 2^32 truncates. With block_size=0x08000000/nblocks=0x20 the guest kmallocd 0x600 (1536) bytes for a 0x100000600 requirement, enqueued 32 usb_mbufs whose data pointers all land past the allocation (m[0] exactly one-past-end = adjacent-slab corruption; m[31] ~3.7 GiB out), and a one-byte write through m[31]->cur_data_ptr produced Fatal trap 12: page fault, supervisor write data, page not present stopped at movb $0x41,(%rax) in the harness. CRITICAL CAVEAT: no in-tree caller can reach a truncating product today (largest is ~94 MB via ugen ISO; all others fixed constants or capped at 256 KiB), so this is a latent CWE-190->CWE-787 hardening defect armed for future callers, not an unprivileged exploit. fix.diff (compute in size_t + reject >0xFFFFFFFFU) validated by full kernel rebuild in the guest: harness then prints allocation FAILED (NULL) and the guest survives.",
  "exploit_chain": "root-only KLD: kldload usbmbuf_of.ko -> usb_alloc_mbufs(0x08000000, 0x20) -> kmalloc(1536) backs only nblocks*48 -> 32 data pointers constructed OOB (first exactly at chunk end = quiet adjacent-slab overwrite primitive, last +3.7 GiB = wild write) -> deterministic kernel page fault. No unprivileged chain exists: every in-tree caller (usb_fifo_alloc_buffer at usb_dev.c:1993 and its 12 driver call sites) is capped >=2 orders of magnitude below the 2^32 truncation threshold.",
  "evidence": "panic.txt lines: kmalloc size (truncated!) = 0x600 (1536) vs bytes truly required = 0x100000600 (4294968832); 32 lines m[N] ... <== OOB (past allocation); Fatal trap 12: page fault while in kernel mode / fault code = supervisor write data, page not present / Stopped at usbmbuf_of_modevent+0x1cb: movb $0x41,(%rax). Patched proof in run.fixed.console.txt: allocation FAILED (NULL), guest up (run.fixed.log, kldload rc=0, uptime clean). build.log: clean -Werror kmod build.",
  "kernel_refs": [
    "sys/bus/u4b/usb_mbuf.c:69",
    "sys/bus/u4b/usb_mbuf.c:71",
    "sys/bus/u4b/usb_mbuf.c:77",
    "sys/bus/u4b/usb_dragonfly.h:92",
    "sys/bus/u4b/usb_dev.c:1993",
    "sys/bus/u4b/usb_generic.c:156",
    "sys/bus/u4b/usb_generic.c:2280",
    "sys/bus/u4b/usb_transfer.c:681",
    "sys/bus/u4b/controller/xhci.c:3767"
  ],
  "poc_changes": "Seed harness authored fresh (no prior seed): iterated 4 build fixes \u2014 added opt_usb.h stub (usb.h includes opt_usb.h in kmod builds), sys/condvar.h + sys/bus.h includes for usb_dev.hs struct cv/device_t, device_if.h+bus_if.h in SRCS, dropped redundant extern of usb_alloc_mbufs (usb_mbuf.h already declares it). Guest has no base64(1) \u2014 switched transport to base64|openssl base64 -d -A.",
  "attempts": 5,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 2340,
  "guest_dirty": 0,
  "build_cmd": "./build.sh  (guest: cd /root/df5664 && touch opt_usb.h && make)",
  "run_cmd": "./run.sh    (guest: cd /root/df5664 && kldload ./usbmbuf_of.ko)",
  "code_hash": "a2d4cc943c1f2265bf499727bffa9650776ce5a37cb64e76d76d791b042b3fe6",
  "notes": "Baseline run kills the guest (ssh hangs mid-kldload; observe via vm.sh log + vm.sh status=down) \u2014 that hang IS the panic observation per the status table. Fix validated with make nativekernel (snapshot has no buildworld tools; nativekernel per /usr/srcs own guidance) + installkernel + reboot: kernel #1 Fri Oct 9 2026. Negative results documented in VERDICT.md: alignment wrap at usb_mbuf.c:65 is benign (wraps to 0 -> ENOMEM); queue macros usb_mbuf.h:46-84 correct; consumer copies MIN()-bounded; M_ZERO kills any uninit leak; the real consumer-side hazard (ugen_transfer_setup dropping priv_lock around usb_fifo_alloc_buffer, usb_generic.c:145-167) belongs to the already-filed DF-5309/5314/5315 race family, not this file.",
  "recommended_fix": "Compute alloc_size in size_t and return NULL when it exceeds 0xFFFFFFFFU (see fix.diff).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": true,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff applied to guest /usr/src/sys/bus/u4b/usb_mbuf.c, kernel rebuilt (make nativekernel) and installed; the identical harness then prints usbmbuf_of: allocation FAILED (NULL) and the guest stays up (kldload rc=0) \u2014 the truncation panic is gone. fix_patched_reproduced=false means the BAD behavior did NOT reproduce on the patched kernel, i.e. the fix holds.",
  "fix_evidence": "run.fixed.console.txt (bytes truly required = 0x100000600 then allocation FAILED (NULL)), run.fixed.log (kldload rc=0 + uptime after load), panic.txt (baseline Fatal trap 12 for contrast)."
}