DF-2777 evidence pack — register_int check-then-create windows (NULL i_thread deref, double-armed systimer)

Finding: sys/kern/kern_intr.c:308-349 — two check-then-create windows span blocking operations, and state is published before the object it describes:

1. info->i_state = ISTATE_NORMAL (:326) is published BEFORE info->i_thread is allocated (:327, M_INTWAIT kmalloc — can block) and created via lwkt_create (:329). A second concurrent register_int for the same (cpu, intr) observes ISTATE_NORMAL with a NULL i_thread and either writes &info->i_thread->td_flags at :349 (INTR_CLOCK path) or leaves the slot ready to blow up in sched_ithd_intern (:589, info->i_thread->td_gd) when an interrupt arrives.
2. The emergency-thread block (:308-319) checks emergency_intr_thread[cpuid] == NULL and then spans lwkt_create + systimer_init_periodic_nq; two concurrent first-registrations on a CPU both create a thread and both (re)initialize emergency_intr_timer[cpuid] — the second systimer_init on an already-armed timer corrupts timer state (crash inside systimer_add, kern_systimer.c).

Rig

Runtime kldload GPFs on this guest, so the interposition is compiled into kern_intr.c as two DORMANT hook points (df2777_hook, no-op unless armed; src/kern_intr.hooks_stock.diffside.c = stock + hooks, src/kern_intr.pristine.c = stock):

• hook(1) immediately after info->i_state = ISTATE_NORMAL; (:326) — stalls the first registrant inside the window;
• hook(2) immediately inside if (emergency_intr_thread[cpuid] == NULL) { (:308) — stalls the first emergency creator (first-through gate).

Scenario 3 additionally uses dfh_reset_emergency(cpu) (rig-only helper in the hooked kern_intr.c) to reopen the boot-time creation window, because on a booted system every CPU already created its emergency thread at boot — documented honestly: the double-arm race is boot-time/first-registration reachable, the rig reopens it to expose the defect.

Scenarios (sysctl dfh.scen2777 + dfh.run2777), two harness threads pinned to cpu2/cpu3 migrating onto the registration cpu:

1. two concurrent register_int(254, INTR_MPSAFE|INTR_CLOCK, cpu2);
2. first registrant stalled mid-window, second completes, then sched_ithd_soft(255) (interrupt arrival);
3. dfh_reset_emergency(2) + two concurrent register_int(254, cpu2).

Expected / observed

• SC1 stock: Stopped at register_int+0x1b9: lock orl $0x20000000,0xd8(%rdx) — the atomic_set_int(&info->i_thread->td_flags, TDF_CLKTHREAD) at :349 with NULL i_thread (fault VA 0xd8 = offsetof(td_flags)).
• SC2 stock: Stopped at sched_ithd_intern+0x1f: movq 0xb8(%rdx),%r8 — info->i_thread->td_gd at :589 with NULL i_thread (VA 0xb8).
• SC3 stock: Stopped at systimer_add+0x15c: movq (%rcx),%rsi (VA 0, thread in CRIT) — second concurrent systimer_init_periodic_nq re-initialized an armed timer and crashed inside systimer_add.
• Fixed (src/kern_intr.hooks_fixed.c = pristine + fix.diff + hooks): all three scenarios survive (SC1/SC3 print non-NULL rec pointers; SC2 degrades to the rate-limited sched_ithd: stray interrupt 255 report) — df2777_fixed.dmesg.

Build/run: harness kernel as in DF-2775 README; stock+hooks build log in build.log.gz, fixed+hooks build log in build.fixed.log.gz. fix.diff = canonical combined fix (DF-2777 hunks: ISTATE_CREATING cmpset gate with publish-thread-before-state, NULL-guard at :349, stray-guard in sched_ithd_intern, emergency once-only cmpset gate).

DF-2777 VERDICT — reproduced (three distinct panics; fix validated)

Bottom line

register_int publishes i_state = ISTATE_NORMAL (kern_intr.c:326) before it allocates/creates i_thread (:327-331) — a window that spans a blocking M_INTWAIT kmalloc and lwkt_create — and its emergency-thread block (:308-319) is a check-then-create spanning lwkt_create + systimer_init_periodic_nq. With dormant hook points compiled into kern_intr.c that stall the first registrant inside these windows (a stand-in for the blocking allocations starving under memory pressure, or any preemption), all three predicted failure modes reproduced exactly on the stock INVARIANTS guest:

• SC1 (panic_sc1.txt): second concurrent register_int(254, INTR_MPSAFE|INTR_CLOCK, cpu2) observed ISTATE_NORMAL with NULL i_thread and executed atomic_set_int(&info->i_thread->td_flags, TDF_CLKTHREAD) (kern_intr.c:349): Stopped at register_int+0x1b9: lock orl $0x20000000,0xd8(%rdx) (write fault at 0xd8 = offsetof(struct thread, td_flags)).
• SC2 (panic_sc2.txt): with the first registrant stalled mid-window and the second's rec already linked, an interrupt arrival (sched_ithd_soft(255)) dereferenced info->i_thread->td_gd (kern_intr.c:589): Stopped at sched_ithd_intern+0x1f: movq 0xb8(%rdx),%r8 (read fault at 0xb8 = offsetof(struct thread, td_gd)).
• SC3 (panic_sc3.txt): two concurrent first-registrations on cpu2 (the boot-time window reopened by the rig-only dfh_reset_emergency, because a booted system has already created every CPU's emergency thread) both entered the emergency block; the second systimer_init_periodic_nq(&emergency_intr_timer[2], ...) re-initialized an already-armed timer and crashed inside systimer_add (kern_systimer.c): Stopped at systimer_add+0x15c: movq (%rcx),%rsi (VA 0, thread CRIT). The stock KKASSERT((info->flags & SYSTF_ONQUEUE) == 0) at kern_systimer.c:148 does not save the code because the re-init wipes flags before arming again — the timer subsystem then runs on corrupted state.

Threat model honesty

Reaching the windows requires two concurrent register_int calls for the same (cpu, intr) — i.e. driver probe/attach races or boot-time first-registration concurrency — or an interrupt arriving during the window of a first registration. All are kernel-internal; an unprivileged user cannot drive register_int directly. Impact = kernel panic (DoS at driver-attach time); no memory disclosure or corruption control was demonstrated beyond the crash. Severity Low as filed is right. The SC3 window on a booted system is closed in practice (first boot-time registration wins permanently); the rig reopens it to expose the defect — labeled as such.

Fix validation

fix.diff (DF-2777 hunks), applied to a pristine tree, hooks preserved:

• ithread creation claimed by atomic_cmpset_int(&info->i_state, ISTATE_NOTHREAD, ISTATE_CREATING), thread built into a local, info->i_thread published BEFORE i_state = ISTATE_NORMAL;
• if (intr_flags & INTR_CLOCK) NULL-guards info->i_thread (the creator sets the flag itself after publishing);
• sched_ithd_intern treats i_thread == NULL as a rate-limited stray;
• emergency block gated by a once-only cmpset.

On the rebuilt fixed kernel (build.fixed.log.gz) the exact same scenarios all survive with the same orchestration: DF2777-SC1: r1=0xfffff8008daa43e0 r2=0xfffff8008daa43a8 -- survived, no NULL-deref; sched_ithd: stray interrupt 255 on cpu3 + SC2 ... survived; DF2777-SC3: ... survived, no double-arm (df2777_fixed.dmesg).

Kernel references

• sys/kern/kern_intr.c:308-319 (emergency check-then-create)
• sys/kern/kern_intr.c:325-337 (state published before i_thread, blocking window)
• sys/kern/kern_intr.c:348-350 (TDF_CLKTHREAD deref of possibly-NULL i_thread)
• sys/kern/kern_intr.c:582-602 (sched_ithd_intern i_thread->td_gd deref)
• sys/kern/kern_systimer.c:144-148 (systimer_add / SYSTF_ONQUEUE assert)

Rig honesty notes

• Hooks are pure no-ops unless a scenario arms them (single flag test); boot-time and driver registration paths were unaffected in 3 booted harness kernels.
• The stalls substitute for real blocking/preemption inside the windows (M_INTWAIT kmalloc under memory pressure, scheduler preemption); they do not create windows that do not exist in the stock code — the hooked lines are exactly the window boundaries the finding cites.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.