DF-2071 PoC — kbdsw dispatch shims skip the kb_index bounds/NULL check

Status: VERIFIED (source-only) + FIX VALIDATED

Only kbd_intr (kbdsw.c:103) validates kbd->kb_index before indexing kbdsw[]. The other 16 dispatch shims deref kbdsw[kbd->kb_index] raw — unsafe if a caller hands in a stale keyboard_t * whose slot was unregistered (kbdsw[i] = NULL in kbd.c:282) or whose kb_index is corrupt.

Latent: kb_index is not attacker-controllable through any in-tree unprivileged path (the cdev entry points re-validate under kbd_token). Needs a separate primitive to manifest (NULL-deref panic).

See VERDICT.md for the full 16-site table and fix validation.

Reproduce

./build.sh   # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh     # source-only confirmation; no runtime PoC (latent)

Fix

fix.diff adds a kbdsw_index_valid(int i) helper mirroring the kbd_intr guard and inserts a check at all 16 dispatch sites (return value matches each function's return type).

DF-2071 — REPRODUCED (source-confirmed, latent) + FIX VALIDATED

Verdict

REPRODUCED via source-only trace. Only kbd_intr() validates kbd->kb_index before indexing the global kbdsw[] dispatch table; the other 16 dispatch shims dereference kbdsw[kbd->kb_index] raw. The bug pattern (missing defense-in-depth check) is confirmed; the finding's latent classification is also confirmed (kb_index is not attacker-controllable through any in-tree unprivileged path).

Mechanism (path:line)

kbdsw[] is a global array of 16 (KBD_MAXKEYBOARDS) function-vector pointers, populated at kbd_register() and cleared to NULL at kbd_unregister() (sys/dev/misc/kbd/kbd.c:282). Each kbd_*() dispatch shim in kbdsw.c is supposed to look up the right switch via kbd->kb_index and call through it.

The bound + NULL check exists in exactly one shim:

• sys/dev/misc/kbd/kbdsw.c:103 c if (i >= 0 && i < KBD_MAXKEYBOARDS && kbdsw[i]) { KBD_LOCK(kbd); error = (*kbdsw[i]->intr)(kbd, arg); KBD_UNLOCK(kbd); }

The comment at kbdsw.c:90-92 even explains why kbd_intr is suspicious: "Be suspicious, just in case kbd_intr() is called from an interrupt before the keyboard switch is completely installed."

The other 16 dispatch sites do not have this guard:

If a caller hands any of these a stale keyboard_t * whose slot has been unregistered (kbdsw[i] == NULL), the deref is a NULL-pointer function-call → panic. If kb_index is corrupt (out of [0,16)), the deref reads a wild kbdsw[] entry → arbitrary kernel function call.

Reachability / impact ceiling

Latent. The cdev-facing genkbd_* entry points (kbd.c:genkbd_open/read/ioctl) re-derive the live keyboard_t * from dev->si_drv1 under kbd_token and validate against keyboard[kbd->kb_index] != kbd at every entry, so an unprivileged /dev/kbdN user cannot normally reach the dispatchers with a stale pointer. The primitive requires a separate bug that hands a stale keyboard_t * to one of the 16 unchecked shims (e.g. a USB/vkbd detach race that loses the kbd_token or skips kbd_unregister's invalidation). If such a path exists the result is NULL-deref panic / local DoS; no memory-corruption primitive is directly derivable.

Fix

fix.diff adds a static inline helper mirroring the kbd_intr guard:

static inline bool
kbdsw_index_valid(int i)
{
        return (i >= 0 && i < KBD_MAXKEYBOARDS && kbdsw[i] != NULL);
}

…and inserts if (!kbdsw_index_valid(kbd->kb_index)) return <sentinel>; at the head of all 16 dispatchers (return value matches each function's return type: ENODEV for int, NOKEY for kbd_read_char, NULL for kbd_get_fkeystr, bare return for the two void shims). The existing kbd NULL check in kbd_ioctl is preserved ahead of the index check.

Matches the finding markdown's recommendation (kbdsw_valid() helper mirroring the kbd_intr guard across all 16 dispatch sites).

Phase-8 build validation

Combined kernel + modules build (DF-2068 / DF-2069 / DF-2070 / DF-2071 / DF-2072) on DragonFly 6.5-DEVELOPMENT #0 baseline:

• === NK_DONE rc=0 === (2026-07-25 11:31:20 UTC)
• 0 error: lines in the full 35,696-line build log
• kbdsw.c is part of in-kernel atkbd/kbdmux/ukbd; the patched TU compiled clean with the kernel's default -Werror flags. nm on kernel.debug confirms the 16 patched dispatch symbols are present (kbd_term, kbd_test_if, kbd_enable, kbd_ioctl, ...). The kbdsw_index_valid helper is static inline so it has no standalone symbol (inlined into each dispatcher).

The default kernel build IS a -Werror build; see fix_build.log and env.txt.

Reproduce

./build.sh    # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh      # source-only confirmation; no runtime PoC (latent)