Summary

pci_setup_msix() validates BAR resources exist and active but never checks mapped sizes large enough for msix_table_offset+msix_msgnum*16 (table) or msix_pba_offset+ceil(msgnum/32)*4 (PBA). pci_mask_msix_allvectors unconditionally writes to every device-reported msix_msgnum (up to 2048) vectors via bus_write_4 at offset=msix_table_offset+index*16+12 blowing past BAR mapping. bus_write_4/bus_read_4 are raw MMIO accesses with no bounds check. msix_msgnum msix_table_offset msix_pba_offset all attacker-controlled from config space. Malicious PCIe device with small BAR (4KiB) and large MSI-X table (2048 entries offset 0). When driver calls pci_setup_msix kernel writes 2048 vector entries at offsets up to 32764 into 4096-byte mapping. Impact: OOB MMIO write/read panic or cross-device register corruption.

PoC verification

Evidence pack

findings/poc/DF-2322 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	analysis: code bug confirmed, gate confirmed, fix authored	1.8 KB	↓ raw
fix.diff	suggested-fix	git-apply-able defense-in-depth fix (verified --check clean)	1.2 KB	view raw
env.txt	environment	guest gate-proof: usbconfig/pciconf/ifconfig/devinfo/sysctl output	2.0 KB	view raw
build.sh	build-script	no-op (no live-device PoC)	255 B	view raw
run.sh	run-script	gate check (required device is absent)	333 B	view raw

VERDICT.md verdict analysis: code bug confirmed, gate confirmed, fix authored

↓ download raw

DF-2322 — PoC verdict

File: sys/bus/pci/pci.c

Verdict: NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth fix.diff is attached.

Mechanism (confirmed in source)

pci_setup_msix() validates the MSI-X table/PBA BAR resources exist and are RF_ACTIVE but never checks the mapped BAR sizes are large enough for msix_table_offset+msix_msgnum*16 (table) or msix_pba_offset+ceil(msgnum/8) (PBA). All three values come from device config space (attacker-controlled on a malicious device); vector writes/pending reads then run off the mapping.

Cited lines

Why it does not reproduce on this guest

No MSI-X-capable PCI device on the QEMU guest. pciconf -lc on every device (PIIX3 host/isa/ata, virtio-net, virtio-blk, vgapci, none0) shows NO MSI/MSI-X capability. The bug requires a malicious PCI device advertising a large MSI-X table against a small BAR; none is present.

Guest gate-proof (full usbconfig/pciconf/ifconfig/devinfo/sysctl/kldstat output) is in env.txt.

Defense-in-depth fix

In pci_setup_msix, after assigning table_res/pba_res, compute table_need=table_offset+msgnum*16 and pba_need=pba_offset+howmany(msgnum,8) and reject with ENXIO + clear the res pointers if either exceeds rman_get_size() of the respective BAR.

The git-apply-able diff is in fix.diff (verified git apply --check clean).

Classification

status: not_reproduced
reproduced: 0
impact: none (not reachable on this guest; latent code bug confirmed in source)
confidence: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
fix_status: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: target device absent on this guest. fix.diff applies clean and is source-correct; no live device to exercise.

git apply --check findings/poc/DF-2322/fix.diff -> OK. No runtime test possible (HW/ACPI/device-gated).

↓ fix.diffper-fix-DF-2322

Detail

Exploit chain

none — valid hard blocker (driver/device path dead at runtime on this guest: no target HW/ACPI/device). No unprivileged->root path.

Evidence (decisive lines)

usbconfig list -> No device match; pciconf -l -> no target HW/capability; ifconfig -> vtnet0 lo0; kldstat -> kernel/ehci/xhci only; sysctl/devinfo -> no target OIDs. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2322/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh}. No PoC source (HW/ACPI/device-gated).

Verified recommended fix

Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2322/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW/ACPI/device-gated on this guest). The bug is REAL in source (traced line-by-line): pci MSI-X table/PBA OOB MMIO, no BAR-size validation (no MSI-X-capable PCI device on QEMU). Gate confirmed via usbconfig list (no devices), pciconf -l (no target HW/capability), ifconfig (vtnet0 lo0 only), kldstat (no target module), sysctl/devinfo (no target ACPI/device OIDs). The benign QEMU environment cannot produce the malicious device/ACPI/descriptor the bug requires.

MSI-X table/PBA out-of-bounds MMIO read/write - no BAR-size validation against attacker-controlled table offset and vector count