DF-2341

NULL-deref panic in if_detach when async PHY-probe attach fails (ether_ifdetach on never-attached ifnet)

Summary

uether_ifattach() returns success immediately after queuing ue_attach_post_task asynchronously but if async task mii_phy_probe() fails it goto fails (:239) WITHOUT ever calling ether_ifattach()/if_attach() and WITHOUT recording failure. Driver believes attach succeeded. When device later detached uether_ifdetach() unconditionally calls ether_ifdetach(ifp) (:294) on ifnet never inserted into global ifnetlist so if_detach() TAILQ_REMOVE writes through if_link.tqe_prev==NULL -> reliable kernel panic null-deref write to address 0. Softc zero-allocated M_ZERO so ifp->if_link.{tqe_next tqe_prev} both NULL (if_attach never ran). Affects aue mos udav-PHY drivers. Trigger: USB Ethernet adapter with non-responding PHY then unplug/detach. Impact: reliable local DoS kernel panic. [VERIFIED pass2: reproduced - uether_ifdetach on mii-probe-failure state drives REAL ether_ifdetach panic at if_down_dispatch+0x66 first NULL in never-attached path; attached-flag fix-validated]

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — bus / platform / cpu
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-476 NULL Pointer Dereference
File: sys/bus/u4b/net/usb_ethernet.c
Lines: 232-294
Area: hw
Discovered: 2026-07-28
Updated: 2026-07-28

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: panic
Confidence: certain
Tested: 2026-10-21 22:01:10
Attempts: 4
Runtime: 600s
Code hash: 1d012b28a66f7342
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC
Build cmd: kernel-compiled rig (DFBATCH)
Run cmd: sysctl debug.dfbatch.cmd="uether mii"

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-21 22:01:10
Runtime: —
Kernel: per-fix-DF-2341
fix.diff: findings/poc/DF-2341/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-2341 · 8 files

File	Type	Size
env.txt	—	412 B	view raw
fix.diff	—	1.0 KB	view raw
panic.txt	—	585 B	view raw
rig	—	4.0 KB	↓ download
run_fixed_kernel.log	—	2.8 KB	view raw
run_kernel_baseline.log	—	172 B	view raw
verdict.json	—	2.1 KB	view raw
fix.diff	—	1.0 KB	view raw

Fix verification

not_testable

↓ fix.diffper-fix-DF-2341

Confirmed kernel references

Detail

Evidence (decisive lines)

panic.txt (baseline: fault 0x0 at if_down_dispatch), run_fixed_kernel.log (returned WITHOUT panic), rig/dfbatch_uether.c + dfb_uether_shims.h (real usb_ether header, verbatim function), fix.diff

PoC changes

fabricated softc uses a real lockinit/usb_proc_create/usb_callout_init_mtx sequence so the failure state is exact; crash site is if_down_dispatch rather than the TAILQ_REMOVE itself (documented - same class, earlier NULL in the same detach path)

Verified recommended fix

record ue_if_attached after ether_ifattach and skip the ether detach when absent

Verdict

Verbatim uether_ifdetach (usb_ethernet.c:267-305) driving the REAL in-kernel ether_ifdetach/if_detach on the failure state ue_attach_post_task leaves when mii_phy_probe fails (softc zeroed, ue_tq/lock/unit set up, ether_ifattach never ran, if_link = {NULL,NULL}): the detach machinery dereferences the never-attached ifnet and the kernel panics (fault virtual address = 0x0, if_down_dispatch+0x66 - the first NULL in the detach path, just before the predicted TAILQ_REMOVE). With the ue_if_attached flag the verbatim function skips the ether detach and returns cleanly. Trigger: USB Ethernet adapter (aue/mos/udav-PHY class) with a non-responding PHY, then unplug - reliable kernel DoS.