VERDICT — DF-2534 (REPRODUCED: use-after-free READ window in real xa_size; NULL-write panic in xa_strategy)

Bottom line

Both cited defects are real and were mechanically demonstrated against the REAL functions (verbatim sha256-gated xdisk.c compiled into the guest kernel, fabricated cdev/softc, interposed disk/dmsg externals):

1. xa_size TOCTOU/UAF read (production-reachable window). xa_size reads sc = a_dev->si_drv1 at :833, NULL-checks it, then dereferences sc->info.d_media_blocks at :835 — with NO lock. xa_terminate_check NULLs si_drv1 at :665 and kfree(sc)s at :680 under xdisk_lk; a reader that loaded the pointer before the NULL-store dereferences freed memory after it. Hammer proof: cpu0 thread in the real xa_size vs cpu1 thread driving the real xa_terminate_check:

   reader xa_size iterations: 157,024,256 (151M on the safe ENXIO path) terminator frees: 51,550,501 (100% same-address LIFO reuse) UAF READS CAPTURED: 664

Each capture is airtight: the reader observed 0xC0FFEE00DF2534 — a value that was only ever written into the slot AFTER kfree(sc) and re-allocation, so the :835 load provably landed after the free (a stale-pointer dereference of freed kernel heap through shipping code). First capture arrived within milliseconds of start.

2. xa_strategy missing NULL check (write-fault panic). :801 loads sc = a_dev->si_drv1 with no check and :805 passes &sc->stats to devstat_start_transaction → with sc == NULL: Fatal trap 12 ... fault virtual address = 0x90, supervisor write data at devstat_start_transaction+0xa: lock xaddl %eax,0x58(%rdi) — 0x90 == offsetof(xa_softc, stats) + 0x58, i.e. a write through the NULL softc exactly as coded. Demonstrated with fabricated state.

Honest narrowness quantification

• xa_size is the live production window. psize is not drained by destruction: diskpsize (sys/kern/subr_disk.c:1259-1276) re-dispatches dev_doperate to the raw device when dssize() returns -1 and the disk sets DSO_RAWPSIZE — which xdisk sets (xdisk.c:491). dev_doperate (kern_device.c:544) has no closing/refs gate; it dispatches straight through si_ops. So a psize racing span-loss teardown reads freed heap. What the primitive yields: an 8-byte read at a fixed offset of a freed M_XDISK slab slot, returned to the caller as the device size (via dssize/DIOCGPART paths) — an attacker-groomable kernel heap info-leak channel (spray an object into the freed slot, read its content at that offset). It is a READ: no control-flow or write primitive; uid=0 is not reachable from this bug alone.
• xa_strategy is practically narrowed by destruction ordering: xa_terminate_check calls disk_destroy at :663 BEFORE NULLing si_drv1 at :665, and disk_destroy→destroy_dev drains device references; xa_terminate_check also refuses to free while bioq/tag_pendq are non-empty (:646-647). So a NULL sc at strategy entry requires a caller that slipped past the drain — the NULL-write panic demonstration is fabricated-state (post-drain) and labeled as such; its value is proving the code has no defense at all if the drain assumption ever breaks.

Threat model (per team directive)

xdisk devices are created by root via dmsg; afterwards the /dev/xa%d nodes are ordinary disks. Whoever can open the node (permissions permitting) can race lseek/size-query paths against span teardown by an unprivileged-triggerable disconnect. Ceiling: 8-byte heap disclosure per hit (Low), repeatable at will; not an escalation primitive by itself.

Fix validation (fixed)

fix.diff takes xdisk_lk and re-checks si_drv1 under it in both functions, matching the file's own idiom (the same lock xa_terminate_check uses to NULL+free). In xa_strategy the bio is queued before the lock is dropped so xa_terminate_check's empty-queue precondition protects the softc; lock order xdisk_lk -> sc->lk matches xaio_rcvdmsg. Applied in guest /usr/src together with DF-2533's fix (combined tree sha256 15d189799d499d96ee6bbb5796ef3b3c5e316fce06d15507a47776119ae43385), kernel rebuilt (#3 Mon Oct 19 21:13:06), EXACT same triggers re-run:

• race: 82,313,216 xa_size iterations vs 30,146,560 frees (100% same-address reuse) → 0 UAF reads (baseline: 664)
• strategy NULL: clean return 0, bio completed with b_error=6 (ENXIO), b_flags=0x800 (B_ERROR) via biodone — no fault

PoC notes

• The magic-value method cannot false-positive: si_drv1 never points at the re-allocated block while set, and the planted value exists only after the free.
• The hammer threads periodically tsleep 1 tick (a spinning kernel thread starves its CPU under the cooperative LWKT scheduler — harness artifact, not part of the finding).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.