Summary

seq_fetch_mid at sequencer.c:724: if(unit>midi_number) should be >=. midis[midi_number] is NULL (M_ZERO, only [0..n-1] populated). Callers dispatch NULL kobj via SYNTH_ALLOC -> o->ops deref at 0x0 -> kernel panic. /dev/sequencer0 /dev/music0 mode 0666 (unprivileged). Device index from user write(). No MIDI hardware needed (midi_number can be 0). Fix: change > to >=.

PoC verification

Evidence pack

findings/poc/DF-1393 · 8 files

File	Type	Description	Size
fix.diff	suggested-fix	Change `unit > scp->midi_number` to `unit >= scp->midi_number` in seq_fetch_mid.	369 B	view raw
VERDICT.md	verdict	Full source-trace analysis	2.1 KB	↓ raw
build.sh	build-script	Kernel build validation	535 B	view raw
run.sh	run-script	PoC runner (not runnable on guest)	774 B	view raw
fix_build.log	build-log	Full kernel build output (make nativekernel rc=0)	5.6 MB	↓ download
env.txt	environment	Guest environment	277 B	view raw
../fix_build_combined.log	build-log	Combined 41-finding kernel build (rc=0, -Werror clean)	5.6 MB	↓ download
../fix_build_summary.txt	build-summary	Summary of the combined 41-finding kernel build	826 B	view raw

VERDICT.md verdict Full source-trace analysis

↓ download raw

DF-1393 — Verification Verdict

Verdict: CONFIRMED-BY-SOURCE-TRACE (module not loaded, not reachable as maxx)

Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)

Mechanism

seq_fetch_mid at :724: if (unit > scp->midi_number || unit < 0) should be >=. scp->midis[] is populated for indices [0..midi_number-1]; midis[midi_number] is NULL (M_ZERO allocation). Callers dispatch NULL kobj via SYNTH_ALLOC, dereferencing ops at 0x0 → kernel panic. midi_number can be 0 (no MIDI hardware needed), so unit=0 triggers the bug.

Source: sys/dev/sound/midi/sequencer.c:724

Why it cannot be reproduced on this guest

NOT reachable as maxx. The sound/midi module is not in GENERIC and not loaded. No /dev/sequencer or /dev/music device nodes exist. Would require kldload (root-only). Device perms are 0666 but device does not exist on this guest.

Phase 6: Escalation Assessment

This is a Module-not-loaded (midi sequencer) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.

Fix

Change > to >= in seq_fetch_mid.

Fix description: Change unit > scp->midi_number to unit >= scp->midi_number in seq_fetch_mid.

The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree and compiles as part of the kernel build (validated via make nativekernel rc=0).

Classification

status: inconclusive
reproduced: 0
impact: none
fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)

Confirmed kernel references

Detail

Exploit chain

none (NULL kobj deref → DoS panic class — no write primitive. Module not loaded on guest; would require kldload which is root-only, invalidating any unprivileged chain per the bright-line rule.)

Evidence (decisive lines)

Source trace: sequencer.c:724 'if (unit > scp->midi_number || unit < 0)' — allows unit==midi_number which is OOB. Guest check: ls /dev/sequencer* → No such file. kldstat shows no sound module.

PoC changes

Authored fix.diff: change > to >= in seq_fetch_mid bounds check.

Verified recommended fix

Change unit > scp->midi_number to unit >= scp->midi_number in seq_fetch_mid. matches finding proposal. Full diff in findings/poc/DF-1393/fix.diff.

Verdict

CONFIRMED BY SOURCE TRACE. seq_fetch_mid at sequencer.c:724 uses unit > scp->midi_number (should be >=). midis[] populated for [0..midi_number-1]; midis[midi_number] is NULL (M_ZERO). Callers dispatch NULL kobj via SYNTH_ALLOC → ops deref at 0x0 → panic. midi_number can be 0 (no MIDI HW needed), unit=0 triggers it. Bug is real but NOT reachable as maxx: sound/midi module not loaded, no /dev/sequencer or /dev/music exist. Would require kldload (root-only).

Off-by-one in seq_fetch_mid yields NULL kobj dereference (local kernel panic via 0666 device)