DF-2491 — Divide-by-zero panic in CHS-mode ata_tf_write from device-controlled geometry

sys/dev/disk/nata/ata-lowlevel.c:771-790 — verified on the audit QEMU guest.

What the finding is

The CHS sub-path of ata_tf_write() takes heads/sectors straight from the device-supplied ATA IDENTIFY words with no zero check and then executes

ata-lowlevel.c:783   ATA_IDX_OUTB(ch, ATA_SECTOR, (request->u.ata.lba % sectors)+1);
ata-lowlevel.c:785   ATA_IDX_OUTB(ch, ATA_CYL_LSB, lba / (sectors * heads));
ata-lowlevel.c:790   DRIVE head field = ((lba % (sectors*heads)) / sectors) & 0xf

sectors==0 → x86 #DE at :783 (lba % sectors); heads==0 → #DE at :785. The sibling consumer of the same words, ad_get_geometry() (ata-disk.c:469-470), guards with && current_heads && current_sectors; the taskfile writer does not. A device that forces CHS mode — ad_get_geometry sets ATA_D_USE_CHS whenever !ad_version(version_major) or !lbasize (ata-disk.c:484-486; ad_version(0)==0) — and reports a zero geometry word panics the kernel on the first I/O, including the geom partition-table probe.

Threat model: malicious/compromised ATA device (or any attacker who can answer IDENTIFY — e.g. USB-UAS bridge firmware, fabricated channel behind a hypervisor, malicious drive firmware) at first disk I/O. Local-denial / malicious-device class (AV:P), same class as DF-2489.

Files in this pack

Reproduce (host, from repo root)

# one fatal scenario per boot (2, 3, 5, 7, 9, 10); controls (1, 4, 6, 8) anytime
sh findings/poc/DF-2491/cycle.sh 7      # full-funnel :783 panic on stock kernel
dfbsd-qemu/vm.sh log 60                 # Fatal trap 18 ... ata_tf_write+0x1f0

Fix validation (already performed, logs in pack): apply fix.diff in the guest /usr/src, make nativekernel && make installkernel, reboot, rerun run.sh 2 3 5 7 9 10 — all return rc=0, no panic, clamped CHS taskfile.

Success criterion

Stock kernel + crafted device geometry in CHS mode ⇒ Fatal trap 18: integer divide fault at ata_tf_write+0x1f0/+0x218 (= ata-lowlevel.c:783/:785) on first I/O. Fixed kernel ⇒ I/O proceeds with sane-clamped CHS taskfile; sane-CHS and LBA devices bit-identical before/after the fix.

DF-2491 — VERDICT

status: reproduced — impact: panic (malicious-device / local-DoS class, AV:P; no memory-corruption primitive, no privesc — pure #DE from device-controlled divisor, TEAM DIRECTIVE: panic — close).

Bottom line

The CHS sub-path of the kernel's own static ata_tf_write() (sys/dev/disk/nata/ata-lowlevel.c:771-790) divides by IDENTIFY-supplied sectors and sectors*heads with no zero check. A crafted ATA device that forces CHS mode (version_major==0 or lba_size==0 → the kernel's own ad_get_geometry sets ATA_D_USE_CHS, ata-disk.c:484-486) and reports a zero geometry word panics the stock INVARIANTS kernel with Fatal trap 18: integer divide fault on the first I/O issued to the disk. Verified six ways (all on the running kernel's own code, plus a sha256-gated verbatim source copy), with the exact trap IPs disassembled and pinned to ata-lowlevel.c:783 and :785, and the fix A/B-validated on a rebuilt kernel: every fatal scenario survives with clamped geometry, controls bit-identical.

Why this is a distinct site from DF-2489 (and why the full funnel matters)

DF-2489 (verified previously) is the division total_secs/(heads*sectors) in ad_attach/ad_describe (ata-disk.c:147/:540). A zero-geometry device trips DF-2489 at attach, before any I/O. DF-2491 is the division in the taskfile writer, reached on I/O — and there is a device population that passes DF-2489's guarded site yet still trips DF-2491:

• IDENTIFY word 53 reports words 54-58 valid (ATA_FLAG_54_58), current_heads=16, current_sectors=0, raw words sane (16/63);
• ad_get_geometry:469-470 requires the flag and non-zero current_heads && current_sectors → guard FAILS → falls to raw 16/63 → ad_attach:147 divides by 1008 → attach SURVIVES (ad0: 0MB <DF2491 ZEROGEOM DISK> on the serial console — go7/go9 logs);
• ad_get_geometry:485-486 still sets ATA_D_USE_CHS (version_major=0);
• ata_tf_write:774 tests only the flag → takes the current_* branch → sectors = current_sectors = 0 → first I/O → #DE at :783.

That is precisely the missing-guard divergence the finding cites ("unlike ata-disk.c which guards with && current_heads && current_sectors").

What ran (stock kernel, INVARIANTS, #0: Thu Jul 2 06:02:54 UTC 2026)

The rig KLD (loaded at boot via loader.conf) dispatches production code only between the crafted device data and the trap:

• Kernel-path tests (go1..go4, go10): the RUNNING KERNEL's own ata_controlcmd() → ata_queue_request() (ATA_STALL_QUEUE + ATA_R_CONTROL → direct HW call, ata-queue.c:98-107) → the kernel's own global ata_generic_hw() wiring → kernel's own ata_begin_transaction() → kernel's own ata_generic_command() (ata-lowlevel.c:648) → kernel's own static ata_tf_write() (ata-lowlevel.c:750). The channel's I/O registers are a kernel-memory register file behind a fabricated struct resource (r_bustag = X86_64_BUS_SPACE_MEM), so the pre-division taskfile writes (:769-770) are satisfied and observable; the division faults before the CHS register writes. Non-fatal variants complete through the kernel's own ata_interrupt() → ata_end_transaction() → tf_read() → ata_finish() → ata_completed() chain (rig "device" thread plays the drive raising READY).
• Verbatim-copy test (go5/go6): production ata-lowlevel.c #included unmodified (build.sh sha256-gates it against the audited tree; 089a2ac25b1000d7ee4f030359884c54bde214e906af684ff1a670d30755d557; only the five global entry points renamed) — same dispatch, trap inside the module copy.
• Full production funnel (go7/go8/go9): the kernel's own ata_identify() on a fabricated channel; IDENTIFY served through the DF-2489-class hw.begin_transaction stub seam (the x86_64 bus_space_read_multi_2 MEM path reads a fixed address per the inline asm — a data FIFO cannot be emulated in kernel memory, so IDENTIFY delivery is the one stubbed seam); everything after — ata_getparam() parse, newbus child, ad_probe(), ad_attach(), ATA_D_USE_CHS gate — is the running kernel's own code on the crafted bytes. The seam is then swapped to the kernel's REAL hw chain and the first I/O is fired with ata_controlcmd() on the REAL kernel-created ad child.

Results matrix

Trap-IP pinning (decisive evidence)

nm /boot/kernel/kernel → ata_tf_write at 0xffffffff8032a910 (local symbol — the kernel's own static copy). Guest objdump of the stock kernel (ata_tf_write_trap_disasm.txt):

ffffffff8032aaef: movzwl 0x12(%rsi),%edi     ; current_heads
ffffffff8032aaf3: movzwl 0x18(%rsi),%r14d    ; current_sectors
ffffffff8032aaf8: movslq %r14d,%r10
ffffffff8032aafe: xor    %edx,%edx
ffffffff8032ab00: div    %r10                ; lba % sectors   <-- TRAP go2/go7/go10 IP
ffffffff8032ab03: lea    0x1(%rdx),%eax       ; +1  → ATA_SECTOR  (:783)
ffffffff8032ab14: imul   %r14d,%edi           ; sectors*heads
ffffffff8032ab28: div    %rdi                ; lba/(s*h)       <-- TRAP go3/go9 IP (:785)

go2/go7/go10 trap IP 0xffffffff8032ab00 = ata_tf_write+0x1f0 = the div feeding (lba % sectors)+1; go3/go9 trap IP 0xffffffff8032ab28 = ata_tf_write+0x218 = the cylinder division. Instruction-for-instruction match with the source lines.

Fix validation (fix.diff, applied in guest /usr/src only)

fix.diff extends the ata_tf_write CHS-branch guard to the exact ata-disk.c:469-470 idiom (&& current_heads && current_sectors), guards the raw-words branch the same way, and clamps to 16/63 when both are invalid:

• kernel rebuilt (make -j6 nativekernel KERNCONF=X86_64_GENERIC, fix_build.log, BUILD_RC=0), rig rebuilt against the fixed source (build.sh checker notes the sha change — expected), rebooted;
• every previously-fatal scenario (go2/3/5/7/9/10) survives with rc=0 and a clamped CHS taskfile identical to the sane control (fix_run.log);
• controls go1/go4/go6/go8 are bit-identical to the stock kernel (same register values, same LBA bit behavior) — no behavior change for sane devices.

Reachability / impact ceiling (honest)

• Reachable at first I/O to any nata disk whose IDENTIFY forces CHS mode with a zero geometry word — including the geom partition-table probe that fires automatically during attach of the disk device (the funnel runs exactly that attach). A malicious device (drive firmware, bridge firmware, or a virtual device presented to the guest) delivers the bytes unauthenticated at attach time (AV:P).
• Impact is panic / local DoS — #DE on a device-controlled divisor; there is no memory-safety primitive (the divisor only selects the fault; the results of the divisions are truncated to taskfile bytes, so even a non-zero bogus geometry yields at most wrong CHS addressing, not OOB). No escalation path; per the team directive (panic — close).
• DF-2489 covers the attach-time division sites; DF-2491 is the I/O-time site, independently reachable via the guard divergence shown in go7/go9 (attach survives, first I/O dies).

Rig honesty note

Fabricated state is strictly: (a) the IDENTIFY bytes (the attacking device), (b) the kernel-memory register file + fabricated struct resource (the device's register interface — this is what a real MMIO IDE block is), (c) the IDENTIFY-serving hw.begin_transaction stub for the attach phase of the funnel (DF-2489-established seam; swapped to the kernel's real chain before the first I/O under test), (d) the newbus device graph around the channel. Nothing between the parsed IDENTIFY words and the division is rig code: ata_getparam, ad_get_geometry, the ATA_D_USE_CHS gate, ata_controlcmd, ata_queue_request, ata_begin_transaction, ata_generic_command and ata_tf_write all execute from the running kernel's own text (trap symbol ata_tf_write+0x1f0/+0x218), and the verbatim #included copy (sha256-gated) traps at the identical offsets.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.