DF-0985

mtw_ucode_write heap overflow via oversized firmware ILM/DLM lengths (firmware-supplied metadata overflows txd_fw->buf[])

Summary

mtw_ucode_write at if_mtw.c:1063-1077: blksz=0x2000 (8192); xferlen=min(len-sent,blksz) up to 8192. memcpy(txd->buf,fw+sent,xferlen) at :1077 + memset(txd->buf+xferlen,0,MTW_DMA_PAD) at :1078. sc->txd_fw=kmalloc(MTW_MAX_TXSZ=2083,M_USBDEV); struct mtw_txd_fw buf[] flexible = 2083-4=2079 bytes. mtw_load_microcode :1195 ilen=le32toh(hdr->ilm_len)-0x40 dlen=le32toh(hdr->dlm_len) from firmware header; check :1198 only compares ilen/dlen to firmware file size (self-consistency), NOT to buffer capacity. Firmware file with ilm_len=0x2200 -> memcpy 8640 bytes into 2079-byte buf -> ~6561 bytes heap overflow into M_USBDEV. Requires root to plant firmware in /boot/modules (firmware_get SYSCAP_NOKLD). Defense-in-depth: driver must not trust on-disk metadata for buffer sizing. Fix: blksz=MIN(blksz, MTW_MAX_TXSZ-sizeof(struct mtw_txd_fw)).

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:N/A:H
CWE: CWE-787
File: sys/bus/u4b/wlan/if_mtw.c
Lines: 1056-1213
Area: hw
Discovered: 2026-07-05
Updated: 2026-07-05

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: likely
Tested: 2026-07-23 11:36:20
Attempts: 1
Runtime: —
Code hash: f60718293a4b5c6d
Guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (with-src, INVARIANTS ON, gcc 8.3)
Build cmd: (combined) make -j6 nativekernel KERNCONF=X86_64_GENERIC
Run cmd: source-only; inspect sys/bus/u4b/wlan/if_mtw.c:1077

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: likely
Tested: 2026-07-23 11:36:20
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT combined 70-finding fix kernel (built rc=0 -Werror 2026-07-23; not booted - source-only)
fix.diff: findings/poc/DF-0985/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-0985 · 2 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited path	420 B	view raw
VERDICT.md	verdict	source-confirmation narrative	1006 B	↓ raw

VERDICT.md verdict source-confirmation narrative

↓ download raw

DF-0985 source-confirmation

Verdict: REPRODUCED (source-confirmed)
Impact: panic Confidence: likely

Kernel ref: sys/bus/u4b/wlan/if_mtw.c:1077

Mechanism

mtw_ucode_write memcpy up to 8192 into 2079-byte buf -> heap overflow (root firmware)

Confirmation method

Source-trace confirmed the cited code path matches the finding (exact line/condition verified against sys/). Runtime PoC not exercised for this source-only Low-severity item; confirmation is by code inspection.

Recommended fix

See fix.diff in this folder (git-apply-able unified diff).

Phase 8 (combined build)

All 70 fixes were batched into one combined patch (../_batch70/combined_70.patch) and applied to in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch70/../_batch70/fix_build.log, 35374 lines). The GENERIC kernel + all modules (drm, firewire, usb, netgraph, smbfs, fuse, crypto, vm, pmap) compiled clean.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED via combined build: fix in combined_70.patch; single make -j6 nativekernel built rc=0, 0 errors under -Werror (../_batch70/fix_build.log). Cited line corrected. Source-only -> validation = clean -Werror compile.

'>>> Kernel build for X86_64_GENERIC completed' + 'NK_DONE rc=0'; grep -cE 'error:|undefined reference' fix_build.log = 0

↓ fix.diffDragonFly 6.5-DEVELOPMENT combined 70-finding fix kernel (built rc=0 -Werror 2026-07-23; not booted - source-only)

Confirmed kernel references

Detail

Exploit chain

none (source-only Low finding, not memory-corruption driven to runtime; no escalation chain)

Evidence (decisive lines)

baseline (with-src #0): bug at sys/bus/u4b/wlan/if_mtw.c:1077. combined-70 fix kernel: NK_DONE rc=0 (0 errors, -Werror).

PoC changes

authored/validated fix.diff (findings/poc/DF-0985/fix.diff); part of combined_70 kernel build.

Verified recommended fix

See findings/poc/DF-0985/fix.diff (git-apply-able). Matches finding proposal.

Verdict

REAL: mtw_ucode_write memcpy of firmware-len into fixed 2079-byte txd_fw->buf (metadata not bounded to capacity) -> heap overflow. root firmware load. confirmed.