DF-2359 — urtwn_efuse_read_data writes past sc->rom (sys/bus/u4b/wlan/if_urtwn.c)

Verdict: NOT REPRODUCED (HW-gated); REAL BUG IN SOURCE (defense-in-depth fix warranted)

Hardware gate (why the PoC cannot run on this guest)

urtwn is the Realtek RTL8188CU/RTL8188EU/RTL8188RU 802.11bgn USB wifi driver. It attaches only when a matching Realtek USB wifi dongle is plugged in. The audit QEMU/KVM guest has no USB device and no wifi interface:

$ usbconfig list               # No device match or lack of permissions.
$ ifconfig -l                  # vtnet0 lo0   (no wlan/urtwn)
$ pciconf -l | grep -iE "realtek|0bda|2357"   # (no Realtek USB wifi chip)
$ kldstat                      # kernel + ehci.ko + xhci.ko only

The eFUSE read path (urtwn_efuse_read → urtwn_efuse_read_data) runs only at attach time once a Realtek RTL8188EU/CU/RU device is present. With no such device the path never executes; the unprivileged maxx user cannot plug a USB dongle into the QEMU guest. The bug auto-triggers on attach from a malicious device's eFUSE contents.

Source trace — the bug is REAL (sys/bus/u4b/wlan/if_urtwn.c)

sc->rom is a union sized to the largest member (if_urtwnvar.h:145-147,211):

union urtwn_rom { struct r92c_rom r92c_rom; struct r88e_rom r88e_rom; };
...
union urtwn_rom  rom;

struct r88e_rom (if_urtwnreg.h:1028-1053) is exactly 512 bytes (URTWN_EFUSE_MAX_LEN == 512, if_urtwnreg.h:1055), and the read call for RTL8188EU passes that size (if_urtwn.c:1959):

error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));  /* 512 */

urtwn_efuse_read_data (if_urtwn.c:1755-1781) writes 8 bytes per off with no bounds check on off:

for (i = 0; i < 4; i++) {
    ...
    rom[off * 8 + i * 2 + 0] = reg;   /* if_urtwn.c:1770 */
    ...
    rom[off * 8 + i * 2 + 1] = reg;   /* if_urtwn.c:1777 */
}

off is computed in urtwn_efuse_read (if_urtwn.c:1819-1836) from device-controlled eFUSE bytes:

if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {   /* extended header */
    off = reg >> 5;
    URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
    if ((reg & 0x0f) != 0x0f)
        off = ((reg & 0xf0) >> 1) | off;     /* if_urtwn.c:1827: off spans 0..127 */
    else
        continue;
} else
    off = reg >> 4;                            /* if_urtwn.c:1831 */

off can reach 127 (7 bits), so off * 8 + 7 reaches index 1023 — but the buffer is only 512 bytes (URTWN_EFUSE_MAX_LEN). For any off >= 64, off * 8 >= 512 writes past sc->rom into the adjacent struct urtwn_softc fields: last_rom_addr, the sc_calib_to / sc_watchdog_ch callout structs (whose struct _callout *toc opaque pointer is dereferenced by every callout operation), and sc_mtx. A malicious RTL8188EU device synthesizes off in [64,127] via crafted eFUSE bytes read through USB vendor requests, overwriting the callout toc pointer with controlled bytes.

Impact: kernel panic / DoS, or local privilege escalation via callout-pointer corruption. Trigger: malicious USB device presenting RTL8188EU VID/PID; auto- loads on plug-in; no user interaction.

Exploit chain status

Not pursuable — primitive (write past sc->rom into softc callout/lock fields) requires the Realtek RTL8188EU device (absent) — valid Phase-6 hard blocker: dead path at runtime on this guest. On hardware this is a write-capable softc- corruption primitive.

PoC changes

None. No Realtek USB wifi dongle on guest; verified by source trace only.

Recommended fix

Bounds-check off against URTWN_EFUSE_MAX_LEN / 8 before the write (skip the entry if out of range). See fix.diff (matches finding proposal: validate off in urtwn_efuse_read_data / its caller).