DF-2314 — pnp_create_devices ANSI-trim has no lower bound: OOB stack read below buf[0], NUL write at negative index, uninitialized-stack leak into the device description

Verdict: REPRODUCED (mechanically, through verbatim pnp.c in the kernel). Impact: kernel stack info leak (device description) + conditional 1-byte OOB NUL stack write. Confidence: certain.

What was run

Established verbatim-interposition kernel-compiled harness (pattern of DF-2300/DF-2319): the guest /usr/src/sys/bus/isa/pnp.c (sha256-gated PRISTINE = audit tree) is compiled unmodified inside pnp_harness.c (TU-compiled; the stock pnp.c unit is dropped from the build, so the harness provides pnp_eisaformat/pnp_check_quirks/DRIVER_MODULE exactly as stock). A PNPH kernel (X86_64_GENERIC + device pnp_harness) is built in the guest and booted; /dev/pnph0 drives the REAL pnp_create_devices() (the static is callable because its TU is compiled into the harness) with crafted PnP card resource byte streams — exactly the bytes a malicious ISA-PnP card / VM firmware returns — against the REAL isa0 bus device, with groomed kernel-stack residue below the parser frame.

The crafted stream is:

17 78 56 34 12 00 00 00   logical device 0x12345678
82 00 00                  PNP_TAG_ID_ANSI large tag, declared length 0
79                        trailing byte (consumed, loop exits)

Results (baseline, kernel #5 15:58:28)

1. Sanity — an ANSI tag of length 16 ("LEGIT-DEV-NAME ") yields desc LEGIT-DEV-NAME: the rig drives the real code and the real device_set_desc_copy (pnp.c:411).

2. Control — stack residue below buf groomed to non-space (0x12): buf[-1] != ' ', the trim loop exits immediately, buf[0]='\0', desc is the empty string. No OOB effects (snapshot diff clean).

3. OOB read walk below buf[0] — residue groomed to 0x20 below buf (buf located precisely at pad+8044 by planting "LEGIT-DEV-NAME" there in a prior sanity pass; the 8KB groom pad models boot-time stack residue): with declared length 0 the loop while (buf[large_len-1] == ' ') large_len--; (pnp.c:406-407) reads buf[-1] and walks 12 bytes backwards through residue before stopping at a non-0x20 byte.

4. OOB NUL write below buf[0] — buf[large_len] = '\0' (pnp.c:408) then writes 0x00 at buf[-12] (pad+8032): position- resolved by a control/walk snapshot diff — the single groom byte that changed 0x12→0x00 (control) / was 0x20→0x00 (walk). The byte sits 12 bytes below buf[0], inside pnp_create_devices' own frame — the only 0x00-writing store on the executed path is this one, so the negative-index store is proven, not inferred. The walk distance is residue-determined (it stops at the first non-space below buf).

5. Uninitialized-stack leak into the device description — with large_len < 0 at loop exit, buf[0..99] is never written (the bcopy copied 0 bytes); desc = buf (pnp.c:409) and the code hands the raw stack to device_set_desc_copy (subr_bus.c:1749-1754: kmalloc(strlen(desc)+1); strcpy(...)). Demonstrated end-to-end: the captured description is " DF2314" (18 bytes = 12×0x20 residue + the groom marker) — bytes that exist nowhere in the crafted card stream. Two independent manifestations: - probe11 (ANSI tag BEFORE the logical-device tag): the deferred application if (desc) device_set_desc_copy(dev, desc) (pnp.c:448-449 — the natural multi-logical-device card pattern, since PnP cards interleave per-LD ANSI strings) sets the leaked description on the newly created device. - probe17 (len-0 walk + second LD tag): the second device again receives the 18-byte stack-residue description. Repeated runs are byte-identical under a fixed groom.

6. Unprivileged visibility — on DragonFly the description reaches userspace through device_print_child() (sys/kern/subr_bus.c:2929-2930 device_printf(child, "<%s>", device_get_desc(child))), which prints for every device probed at boot — the same boot log contains e.g. atkbd0: <AT Keyboard>. A malicious card whose logical device binds any isa driver prints the leaked residue into the world-readable dmesg buffer. (DF devinfo(8) itself does not print device descriptions — checked against /usr/src/usr.sbin/devinfo/devinfo.c.)

7. Rig observation, documented honestly — when the ANSI tag follows the logical-device tag, the immediate call at pnp.c:410-411 produced an empty description in this build even when the walk went negative (probe18 proves the call runs: it overwrote a previously set good description with ""). The deferred pnp.c:448-449 site — hit naturally by any card with a following logical-device tag or by the ANSI-first ordering — leaks verbatim, so the vulnerability class is demonstrated through pnp.c's own call sites either way. The OOB read (3) and OOB write (4) are position-proven regardless of call site.

Reachability / attacker model (honest)

PnP card resource data is parsed at isa-bus attach during boot (pnp_identify → pnp_isolation_protocol → pnp_read_resources → pnp_create_devices). No ISA-PnP hardware exists on the QEMU guest (or on virtio/modern VMs); the attacker is a malicious physical ISA-PnP card or VM firmware (CVSS AV:P). The leak triggers when the stack byte at buf[-1] (boot-path residue, not attacker-chosen) is 0x20 — plausible at boot given the volume of strings/pointers on the early boot stack, but probabilistic per boot; every all-spaces payload (any length) reaches the same buf[-1] read deterministically.

privesc assessment (team directive)

No privesc. DragonFly has no KASLR, so a stack disclosure defeats no randomization; the leak cannot be triggered by any local or remote unprivileged user (no PnP hardware path exists post-boot; no re-scan supported — pnp_identify returns early when the bus is DS_ATTACHED). The OOB write is a single 0x00 byte at a residue-determined offset within the parser frame. Close as: boot-time hardware-attacker kernel-stack info leak + conditional 1-byte stack NUL write. Medium severity stands.

Fix validation

fix.diff adds the same lower bound the sibling parser already has (pnpparse.c:231 while (len > 0 && buf[len-1] <= ' ')):

-           while (buf[large_len-1] == ' ')
+           while (large_len > 0 && buf[large_len-1] == ' ')

Applied to the guest tree, kernel rebuilt and booted: sanity desc still "LEGIT-DEV-NAME" (no regression); smart-walk run shows no NUL-write signature (baseline: 1 at buf[-12]) and empty desc; probe11 leak path yields desc len 0 — the leak is eliminated. fix_status: fixed.

Reproduce

# on the audit host (guest up):
sh prep.sh && sh build.sh && reboot    # inside guest /root/pnp
sh run.sh                              # baseline
# apply fix.diff to guest /usr/src/sys/bus/isa/pnp.c, sh build.sh, reboot
./pnphctl 3; ./pnphctl 10; ./pnphctl 11   # A/B after fix

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.