DF-2306 — Unconditional PCI vendor/device ID console disclosure in probe

Verification pack for finding DF-2306 (sys/bus/firewire/fwohci_pci.c:190-191). Info / kernleak. Claim: the generic-class fallthrough in fwohci_pci_probe prints the PCI vendor and device IDs to the console with device_printf unconditionally — no bootverbose/firewire_debug guard — for every 1394-OHCI controller not in the hard-coded ID table.

Verdict (short)

REPRODUCED line-accurately and mechanically: the REAL fwohci_pci_probe (verbatim TU rig) invoked with a fabricated PCI identity of class=0x0c/0x00/progif=0x10 (generic 1394 OHCI) and vendor/device (0x1a2b/0x3c4d) NOT in the table, fell through to the class match and printed fwohci6: vendor=1a2b, dev=3c4d to the console, set the description, and returned 0. On real hardware this line appears on every boot for any OHCI controller absent from the ID table (the table has 25 entries; plenty of controllers, e.g. many TI/NEC/Lucent revs and all newer chips, fall through). Info-severity: PCI IDs are semi-public hardware identifiers, but they do fingerprint the exact controller and the print is unconditional boot noise; the specific-ID matches above print nothing.

Files

Same rig as DF-2304 (shared verbatim-interposition harness): * fwpci_harness.c/h, fwohci_harness.c/h, fwpcictl.c — rig * run.sh — fwpcictl probe 0x1a2b 0x3c4d 0x0c 0x00 0x10 + dmesg check * run.log — baseline console output (the disclosure line) * run_fixed.log — fixed kernel: silent at bootverbose=0, prints at 1 * fix.diff — combined 3-hunk fix (hunk 1 guards the print)

Reproduce

scp -F dfbsd-qemu/config * dfbsd:/root/fwo/
vm.sh run_root 'sh /root/fwo/fwpci_prep.sh && sh /root/fwo/build_kernel.sh'
vm.sh down && vm.sh up
vm.sh run_root 'sh /root/fwo/run.sh'      # dmesg shows: fwohci6: vendor=1a2b, dev=3c4d

DF-2306 VERDICT — unconditional vendor/device ID print in probe fallthrough

• finding: DF-2306, fwohci_pci.c:190-191 (fwohci_pci_probe)
• status: reproduced (the exact print behavior demonstrated through the verbatim probe function)
• impact: leak (hardware-identifying console disclosure; Info severity — PCI IDs are enumerable by other means by anyone with local access to the bus, but the print is unconditional and unguarded)
• confidence: certain

Line-accurate analysis

fwohci_pci.c:187-194: after the 25-entry hard-coded ID table fails to match, the generic class check pci_get_class==PCIC_SERIALBUS && subclass==PCIS_SERIALBUS_FW && progif==PCI_INTERFACE_OHCI executes device_printf(dev, "vendor=%x, dev=%x\n", pci_get_vendor(dev), pci_get_device(dev)); with NO guard — then sets the description and returns 0. Every specific-ID match above prints nothing. The driver has no other probe-time print. Sibling style in the same file: probe-time / attach-time noise elsewhere is guarded by if (bootverbose) (fwohci_pci.c:261-262) or if (firewire_debug) (fwohci_pci.c:238).

Mechanical reproduction (this run)

fwpcictl probe 0x1a2b 0x3c4d 0x0c 0x00 0x10 drives the REAL fwohci_pci_probe on the rig shell (parent = fabricated pci bus kobj serving BUS_READ_IVAR). Console/dmesg:

FWP: PROBE vendor=1a2b device=3c4d class=0c subclass=00 progif=10 -> REAL fwohci_pci_probe(0xffffffff817b14c0)
fwohci6: vendor=1a2b, dev=3c4d
FWP: PROBE returned 0 desc="1394 Open Host Controller Interface"

The disclosure line is emitted by the stock code path; rc=0 and the description are set as in a real boot. (No 1394 hardware exists on the guest — the print targets the fabricated identity; the code path is byte-identical to what a fall-through controller hits at every boot.)

Fix validation (A/B)

fix.diff hunk 1 wraps the print in if (bootverbose) (sibling style). Fixed kernel (run_fixed.log): * bootverbose=0 -> probe returns 0, description set, NO console line. * bootverbose=1 (rig sets the kernel variable) -> the line prints. Baseline vs fixed: unconditional print vs bootverbose-gated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.