pps_fetch_timeout() feeds user-supplied unnormalized tv_nsec into tstohz_low(), whose int truncation yields an attacker-chosen (possibly negative) sleep tick count

Summary

PPS_IOC_FETCH passes the user's pps_fetch_args.timeout to pps_fetch_timeout() after validating only tsformat and non-zero-ness; tv_nsec range is never checked. pps_fetch_timeout() then calls tstohz_low() whose documented contract requires a normalized non-negative timespec. A negative or ≥1e9 tv_nsec makes the (u_long)ts->tv_nsec/nstick quotient astronomically large and the (int) cast truncates it to an arbitrary int32 "to" — including negatives — passed to tsleep(). Bounded impact: negative values clamp to 1 tick (callout layer documents negative to_ticks as legal) and huge positives just produce a long ETIMEDOUT sleep; only the caller's own ioctl wait semantics are perturbed. Reachability additionally requires a /dev/ppsN node (driver not in GENERIC; absent from the guest) plus parallel-port PPS hardware.

Recommended fix

--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1669,6 +1669,10 @@ pps_ioctl(u_long cmd, caddr_t data, struct pps_state *pps)
        if (fapi->tsformat && fapi->tsformat != PPS_TSFMT_TSPEC)
            return (EINVAL);
        if (fapi->timeout.tv_sec != 0 || fapi->timeout.tv_nsec != 0) {
+           if (fapi->timeout.tv_sec < 0 ||
+               fapi->timeout.tv_nsec < 0 ||
+               fapi->timeout.tv_nsec >= 1000000000)
+               return (EINVAL);
            err = pps_fetch_timeout(&fapi->timeout, pps);
            if (err != 0)
                return (err);

Timeline

• 2026-08-30 Discovered during pass-2 audit of kern_clock.c (GLM 5.3).