unregister_int dereferences the caller-supplied (possibly stale/freed) cookie before and after validation → freed-heap read and arbitrary-pointer %s print

Summary

unregister_int() reads intr = ((intrec_t)id)->intr before any validation of id, and when the record is not found it prints ((intrec_t)id)->name as %s — both dereference the cookie after it may already have been freed by a previous teardown. nexus_teardown_intr passes the cookie straight through with no double-teardown guard and never clears it, so any driver calling bus_teardown_intr twice with a stale cookie (a classic driver error-path bug) makes the kernel read freed heap and print a string through whatever pointer now occupies rec->name — arbitrary-address string read to console/log — or panic.

Threat model & preconditions

Requires a buggy driver performing double teardown (root-triggered detach or shutdown error paths); the kernel turns the driver bug into an arbitrary-pointer string print instead of ignoring the stale cookie.

Recommended fix

Treat a not-found id as a benign no-op without dereferencing it (print the pointer, not the name): see row diff.

Timeline

• 2026-08-31 Discovered during pass-2 audit of kern_intr.c (GLM 5.3).