DF-1216 — METEORSETGEO + METEORSACTPIXFMT pixel-format mismatch

Verdict

REPRODUCED (source-level harness). The bug is real and the OOB read/write arithmetic is confirmed; impact ceiling is OOB kernel-heap read (read()) + OOB kernel-heap write (start_capture bzero/RISC DMA). The kernel code path cannot be triggered on this audit guest because QEMU does not emulate the Brooktree Bt848 PCI video-capture device — /dev/bktr0 does not exist and the PCI vendor/device IDs (109e:0350/0351) are absent from pciconf -lv. The fix.diff applies cleanly to the in-guest source tree and nativekernel succeeds (rc=0); no run-time exercise of the path is possible on this guest because the device is missing.

Mechanism (cited path:line, confirmed against sys/dev/video/bktr/bktr_core.c)

1. METEORSETGEO at bktr_core.c:1657 computes the bigbuf allocation as temp = geo->rows * geo->columns * geo->frames * 2. The literal * 2 hard-codes YUV_422 (Bpp=2). The buffer is mapped into alloc_pages pages.
2. METEORSACTPIXFMT at bktr_core.c:2328-2337 accepts any index 0..11 from the user, assigns bktr->pixfmt = *(int *)arg, and returns. It does not verify that the new format's Bpp is compatible with the already- allocated bigbuf, and does not reallocate.
3. video_read at bktr_core.c:1084-1085 computes count = rows * cols * pixfmt_table[bktr->pixfmt].public.Bpp. With pixfmt=5 (RGB 4Bpp from pixfmt_table[5] at bktr_core.c:230) and the YUV-sized buffer, count is 2× the buffer size.
4. uiomove at bktr_core.c:1106 then reads count bytes out of bigbuf, reading up to count - alloc_pages*PAGE_SIZE bytes past the end (OOB heap read → kernel-memory info leak).
5. start_capture at bktr_core.c:3519-3524 does bzero(bigbuf, rows*cols*frames*pixfmt_table[bktr->pixfmt].Bpp) and the RISC DMA builder uses pitch = cols*Bpp(new) → OOB heap write (up to ~4 MiB past buffer end).

The attacker needs only an open bktr fd (the device is cr--r--r-- world-readable per the finding, although the open may further be gated by caps_priv_check_self); the two ioctls + read() sequence is fully unprivileged on real hardware.

Harness proof (harness.c)

Extracts the exact pixfmt_table[] from bktr_core.c:220-238 and the exact arithmetic from lines 1657, 2333, 1084, 3522, and prints the OOB length:

After METEORSETGEO(YUV_422): bigbuf=4186112 bytes alloc_pages=1022
video_read OOB=4177936 bytes  start_capture OOB=4177936 bytes
CONFIRMED: read() reads 4177936 bytes past bigbuf end (heap leak);
           start_capture bzero/DMA writes 4177936 bytes past bigbuf end (heap corruption)

Reproduced deterministically over 3 runs.

Exploit-chain note

This is a write-capable primitive on real hardware. Because the audit guest lacks the Bt848 device, no kernel-side chain can be developed here. The OOB write is large (~4 MiB), so a successful trigger on real HW would corrupt adjacent kernel heap and yield a reliable DoS at minimum; exploitation (strings-into-heap would require additional research but the offset is attacker-tunable via rows/cols/pixfmt). Documented here as a primitive characterization only; impact ceiling for this run is heap-corruption DoS / info-leak.

PoC changes

• Replaced the original poc_bpp_mismatch.c (which attempts to open /dev/bktr0 that does not exist on this guest) with harness.c, a self-contained userland reproduction of the cited arithmetic.
• Added fix.diff, build.sh, run.sh, env.txt, VERDICT.md, manifest.json, full build.log/run.log/fix_build.log.

Fix

fix.diff adds the missing bounds check inside METEORSACTPIXFMT: bktr->rows * bktr->cols * bktr->frames * pixfmt_table[idx].Bpp must not exceed alloc_pages * PAGE_SIZE when bigbuf != 0. This is the targeted root-cause fix; it supersedes the finding markdown's "clamp count in video_read" note by closing the bug at the actual configuration-change point so neither video_read nor start_capture can ever see a too-large Bpp.

Fix-validation

The diff applies cleanly (patch -p1 --forward, hunk #1 succeeded at line 2330) and make -j6 nativekernel KERNCONF=X86_64_GENERIC completes with rc=0 (fix_build.log). The kernel-side before/after run cannot be demonstrated on this guest because the device is absent, so fix_status: "not_testable" — the diff is verified to compile and the changed logic is traced to close the cited code path.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.