DF-2910 — disklabel64 read-path trust → arbitrary absolute-media-offset I/O via partition devices of crafted media

Impact upgrade of DF-0134 (which established the missing structural validation; this pack concretely demonstrates and fixes the resulting I/O redirection primitives).

What was proven (baseline, stock INVARIANTS kernel #0, 3/3 deterministic runs)

Attacker-controlled media (image file / USB disk) containing a CRC-valid disklabel64 with uncontained partition fields is auto-parsed by the kernel at attach time (disk_probe → disk_probe_slice, sys/kern/subr_disk.c:491). l64_readdisklabel (sys/kern/subr_disklabel64.c:145-201) checks only magic / d_npartitions<=16 / CRC — never bounds. Partition devices are then created, and dscheck (sys/kern/subr_diskslice.c:206-212,280-281) routes their I/O using (sp->ds_offset + slicerel_secno) * dss_secsize — mod-2^64 arithmetic with no containment check against the slice:

1. Cross-slice read/write — p_boffset beyond the slice end: /dev/vn0s1a (partition of the 1 MiB slice s1) reads/writes slice s2's data at absolute LBA 6144. → slice isolation broken; a mounted attacker slice can read/modify other slices of the same disk (e.g. an OS partition, the running system's raw data).
2. Wraparound slice escape (backwards) — p_boffset = 2^64-983040: (2048 + 2^55-1920)*512 mod 2^64 = 65536 → /dev/vn0s1b reads absolute LBA 128, before the slice start (kernel itself reports media_offset=65536 via DIOCGPART).
3. Universal window — one partition p_boffset = p_bsize = 2^64-512 yields a 2^55-sector window (media_offset=LBA 2047, media_blocks=2^55-1); the user's own partition-relative seek selects the absolute target.
4. EROFS label-area protection bypass — writing slice-rel sector 1 via the whole-slice device is correctly rejected EROFS (ds_reserved=8), but the same byte written through the crafted partition (slicerel_secno ≈ 2^55 → not < ds_reserved) succeeds: write(/dev/vn0s1c, sec=2) = 512 and the on-disk label magic at absolute LBA 2049 is overwritten ("PWNED-PARTITION-WRITE" on raw read-back).

No panic; guest stays up; primitives are fully controlled read/write at attacker-chosen absolute media offsets. Ceiling: with root attaching/opening attacker media (automount, vnconfig, USB), all slice/label protections on that disk are void — cross-slice data theft and targeted corruption (MBR, foreign labels, other OS's data). It is disk-data redirection, not kernel-memory corruption.

Build / run (in guest, as root)

# host: generate the crafted image (python3, no deps)
python3 makeimg.py df2910.img
# guest: attach; kernel auto-probes the crafted label
vnconfig -c vn0 /root/df2910.img
sh run.sh          # full sequence: dump label, 3 read primitives, EROFS control+bypass

Expected (vulnerable kernel): SLICE2-SECRET-MARKER via vn0s1a, SECTOR128-SECRET-MARKER via vn0s1b, EROFS via vn0s1 control, write=512 ok via vn0s1c and PWNED-PARTITION-WRITE at raw LBA 2049.

Expected (patched kernel): vn0s1: cannot find label (disklabel64 corrupted, partition) in the message buffer; only /dev/vn0s1 exists; every primitive absent; valid labels (valid.img) still install with working partition I/O and EROFS intact.

Fix

fix.diff adds structural validation to l64_readdisklabel (label total/boot-area and every partition bounded within sp->ds_size * secsize, sector-aligned, wrap-safe sums). Validated in-guest: baseline reproduces, patched kernel rejects the crafted label and accepts valid ones (run.fixed.log, run.fixed2.log).

DF-2910 VERDICT — reproduced / OOB I/O (disk-data redirection, slice escape, EROFS bypass)

Classification

• status: reproduced (3/3 deterministic baseline runs; no panic; guest stable)
• impact: dos-level ceiling is not the point — this is out-of-bounds I/O: kernel-mediated read/write at attacker-chosen absolute media offsets through partition devices created from attacker-crafted media. Not kernel-memory corruption; disk-data boundary break.
• confidence: certain — every step traced to source and demonstrated empirically.

Root cause chain (path:line)

1. sys/kern/subr_disk.c:491 — every BSD-type MBR slice is label-probed at attach (disk_probe_slice), zero user interaction beyond media presence.
2. sys/kern/subr_disklabel64.c:183-187 — l64_readdisklabel validates only d_magic, d_npartitions<=16, CRC. p_boffset/p_bsize/d_bbase/d_total_size are never checked against the media/slice (this is the DF-0134 gap).
3. sys/kern/subr_disk.c:228-269 — partition devices are created for every partition with nonzero p_fstype, regardless of geometry.
4. sys/kern/subr_diskslice.c:206-212 — dscheck takes start/blocks straight from l64_getpartbounds (subr_disklabel64.c:64-82) with no clamp to sp->ds_size (contrast the WHOLE_DISK/WHOLE_SLICE branches at :189/:197 which use ds_size).
5. sys/kern/subr_diskslice.c:280-281 — nbio->bio_offset = (off_t)(sp->ds_offset + slicerel_secno) * ssp->dss_secsize — mod-2^64 arithmetic: huge p_boffset wraps the product to any small absolute offset; the EROFS reserved check at :227 (slicerel_secno < sp->ds_reserved) never fires because the wrapped slicerel_secno is astronomically large.

What was demonstrated (baseline, kernel #0 stock INVARIANTS)

• Cross-slice read: /dev/vn0s1a (partition of 1 MiB slice s1, p_boffset=2 MiB) returned SLICE2-SECRET-MARKER living in slice s2 (abs LBA 6144) — run.log §1.
• Wraparound backwards read: p_boffset=0xffffffffff10000 → kernel-reported media_offset=65536 (DIOCGPART) → /dev/vn0s1b returned the marker at abs LBA 128, before the slice start — run.log §2.
• Universal window: p_boffset=p_bsize=0xfffffffffffffe00 → media_blocks=2^55-1 (16 EiB) partition whose user-relative seeks map to arbitrary absolute offsets — run.log §3/pinfo.
• EROFS bypass write: control write via /dev/vn0s1 at slice-rel sec 1 → EROFS (errno 30); identical byte via /dev/vn0s1c at sec 2 → write()=512 ok, raw read-back at abs LBA 2049 shows PWNED-PARTITION-WRITE — the on-disk label magic clobbered through a partition device. run.log §4-6.
• Stable across runs (run.log, run.2.log, run.3.log); guest alive; no panic.

Threat model

Unprivileged attacker supplies the media (USB stick, disk image, cloud volume); root (or an automount daemon) attaches it and the kernel auto-parses the label. Partition devices appear root:operator 0640. Root opening/mounting the crafted slice gives the attacker cross-slice read/write of the same physical disk — including the MBR, foreign labels, and other OS partitions — plus voiding of the label-area EROFS protection. On the PoC guest the trigger is vnconfig (root). Severity Medium: powerful primitive, but requires privileged attach/open of attacker media (no unprivileged local trigger found; the DIOCSDINFO/WDINFO64 install path is separately bounds-checked in l64_setdisklabel modulo DF-0135).

PoC changes vs. seed

Seed sketch did not exist (finding filed from this run). Generator initially computed the wrap p_boffset as target - ds_offset*512 per-partition; corrected after guest ground-truth (DIOCGPART media_offset) showed the general form: backwards reach comes from (ds_offset + p_boffset/512)*512 mod 2^64 — best expressed as one partition with p_boffset = p_bsize = 2^64-512 plus a user seek. CRC32 is zlib-compatible (sys/libkern/crc32.c table = 0xEDB88320 reflected).

Fix validation (mandatory — memory-boundary class)

• fix.diff: structural validation in l64_readdisklabel (total/boot-area contained; each partition sector-aligned, p_boffset<=slicebsize, p_bsize<=slicebsize, p_boffset+p_bsize<=slicebsize — terms bounded first so the sum cannot wrap).
• Baseline reproduced on kernel #0; guest vm.sh reset with-src, patch applied to /usr/src, make -j6 nativekernel && make installkernel, reboot → kernel #1.
• Patched result: kernel log vn0s1: cannot find label (disklabel64 corrupted, partition); no vn0s1a/b/c devices; all primitives absent (run.fixed.log, run.fixed2.log); label magic at LBA 2049 intact.
• No false positives: a fully-contained label (valid.img) is accepted on the patched kernel; vn1s1a created with correct in-slice media_offset, read/write round-trip works, EROFS reserved protection enforced (EROFS on whole-slice write at sec 1).
• Note: on the patched kernel an unlabeled slice has ds_reserved=0, so whole-slice writes into the (absent) label area succeed — pre-existing behavior for label-less slices, not a regression of this fix.

fix_status: fixed — baseline reproduced / patched behavior gone / valid labels unaffected.