DF-2959 — clist_qtob called with unclamped len in ucom_get_data TX path (heap OOB write, latent)

What

sys/bus/u4b/serial/usb_serial.c ucom_get_data() (the tty→USB data pump):

1898        usbd_get_page(pc, offset, &res);
1899
1900        /* Buffer bigger than max requested data */
1901        if (res.length > len) {
1902            res.length = len;              /* segment clamped to request */
1903        }
1904        /* copy data directly into USB buffer */
1905        SET(tp->t_state, TS_BUSY);
1906        cnt = clist_qtob(&tp->t_outq, res.buffer, len);   /* BUG: len, not res.length */

usbd_get_page() (sys/bus/u4b/usb_busdma.c:80-125) returns the contiguous segment starting at offset:

• single-segment DMA buffer (ismultiseg == 0): res.length = (usb_size_t)-1 → after the clamp it equals len → harmless;
• multi-segment / page-scattered cache (ismultiseg != 0): res.length = USB_PAGE_SIZE - (offset % USB_PAGE_SIZE) — as short as 1 byte;
• Case 1b (pc->buffer == NULL): res.buffer = page->buffer + offset — a per-USB-page buffer allocation, NOT part of one large KVA mapping.

clist_qtob() (sys/kern/tty_subr.c:127-149) copies n = min(len, c_cc) bytes of tty output data to res.buffer and returns the count. Passing the uncapped len (the driver's whole bulk-out buffer size, e.g. UPLCOM_BULK_BUF_SIZE at uplcom.c:838) instead of the clamped res.length makes the copy run past the contiguous segment whenever t_outq.c_cc > res.length — writing attacker-supplied tty bytes (whatever the user write()d to /dev/ttyU*) past the end of a USB page buffer (heap OOB write, length up to len - res.length, content and timing attacker-controlled). The RX twin in the same file (usb_serial.c:2004-2032) does it correctly: buf = res.buffer; cnt = res.length; clist_btoq(buf, cnt, …), confirming the TX line is a defect, not a design choice.

Reachability (honest)

• Requires a USB serial adapter attached and its /dev/ttyU* open (driver runs ucom_get_data from the bulk-out TX callback). No privileged ioctl is involved — any user able to write the device node triggers the copy.
• In the common x86 configuration the serial drivers allocate a single-segment (≤1 page) bulk buffer → ismultiseg == 0 → res.length = -1 → clamp makes res.length == len → bug masked. The overflow needs a multi-segment (page-scattered / multi-page) TX page cache or a Case-1b (non-KVA) buffer, which the stock serial drivers do not normally produce. Treated as a latent heap-overflow / correctness defect (the clamp exists and is then ignored), not a demonstrated exploit path.
• QEMU guest: ucom.ko/uplcom.ko/uftdi.ko are present but no USB hardware is attached (ls /dev/ttyU* → No such file or directory), so the path cannot be exercised on the audit guest.

Fix

Pass the clamped segment length (see fix.diff — mirrors the RX path).

Reproduce

Static-analysis finding; no runnable trigger was possible on the audit guest (no USB device). See VERDICT.md.

VERDICT — DF-2959

Status: untested (out of Phase-V scope: Low severity, latent reachability, and the audit QEMU guest has no USB serial hardware). This pack documents a static-analysis-confirmed defect found during the pass-2 consumer sweep of sys/kern/tty_subr.c (the clist API): a caller passes an unclamped length to clist_qtob, whose documented contract (tty_subr.c:127-149) trusts n as the destination bound.

Why this is a real defect (code-level certainty)

1. sys/bus/u4b/serial/usb_serial.c:1898 obtains the contiguous DMA segment (res.buffer, res.length) via usbd_get_page.
2. usb_serial.c:1900-1903 clamps res.length to the request — proving the author's intent that at most res.length bytes may touch res.buffer.
3. usb_serial.c:1906 then ignores the clamp and calls clist_qtob(&tp->t_outq, res.buffer, len) with the full request length len (e.g. UPLCOM_BULK_BUF_SIZE, uplcom.c:838).
4. clist_qtob writes exactly min(len, t_outq.c_cc) bytes to res.buffer (tty_subr.c:138-144) — the only bound it enforces is the queue count.
5. usbd_get_page (usb_busdma.c:96-108) yields res.length = USB_PAGE_SIZE - (offset % USB_PAGE_SIZE) for multi-segment caches (as low as 1), and for Case 1b returns res.buffer = page->buffer + offset, a standalone per-page allocation — so a segment overrun is a heap OOB write into foreign memory, not merely into slack of one big mapping.
6. The sibling RX path in the same function family (ucom_put_data, usb_serial.c:2004-2032) uses res.length correctly (buf = res.buffer; cnt = res.length; … clist_btoq((char *)buf, cnt, …)), so the TX line is an asymmetry/bug, not a subtlety.

Overflow preconditions: multi-segment (or non-KVA) TX page cache AND t_outq.c_cc > res.length. Both are satisfiable by the API contract but are not produced by the stock serial drivers on x86 (single-segment ≤1-page bulk buffers → res.length = (usb_size_t)-1 → clamp == len). Hence "latent".

Impact ceiling (if preconditions met)

Kernel heap out-of-bounds write: contents = bytes the user previously write()d to the /dev/ttyU* device (fully attacker-chosen), length = min(len, queued bytes) - res.length (up to ~1KB), repeatable per TX callback. That is a classic heap-corruption primitive → potential local privilege escalation on machines with USB serial adapters; not demonstrated here because no such hardware exists on the guest.

Why not reproduced on the guest

• vm.sh run_user 'ls /dev/ttyU*' → No such file or directory; ucom.ko, uplcom.ko, uftdi.ko, u3g.ko exist in /boot but there is no USB device for the drivers to bind, so ucom_get_data never executes.
• Severity Low (hardware-gated, masked in common config) → per contract, Phase V is conditional and was not warranted for this finding.

Negative results recorded during the same pass-2 sweep

(everything hunted in tty_subr.c itself and its consumers, all killed)

• Ring arithmetic clist_getc/putc/btoq/qtob/ndflush/unputc: single subtraction i -= c_ccmax is sufficient under the invariants 0 <= c_cchead < c_ccmax, 0 <= c_cc <= c_ccmax, which every function preserves for non-negative inputs — tty_subr.c:113-116,140-141,161-163, 179-181,205-207,282-284.
• clist_alloc_cblocks shrink/grow copy math (tty_subr.c:64-76): proven in-bounds (count <= ccmax, n <= c_ccmax-c_cchead, count-n <= c_cchead).
• Blocking-kmalloc(M_INTWAIT) TOCTOU (tty_subr.c:61-80): killed — LWKT tokens are re-acquired before the blocked thread resumes, so the post-kmalloc field reads (lines 64-80) run under the caller's tty token; the "NOTE: cl fields may now be different" comment is handled by the fresh re-read.
• sio interrupt vs tty-softcall concurrency: killed — sio touches clists only via comstart/comparam/comstop, each reached with tp->t_token held (ttstart tty.c:1549-1556, ttyinput tty.c:404, ttyflush tty.c:1433, ttioctl tty.c:1056); sioinput→ttyinput takes the token itself (tty.c:404).
• Huge clist_alloc_cblocks size via user termios.c_ispeed (tty.c:1082 → ttsetwater:2439,2456): killed for reachable devices — sio's comparam rejects c_ispeed != c_ospeed and invalid divisors (sio.c:2275-2283); ptys have t_ispeedwat == 0 → clamped legacy path (tty.c:2444-2449).
• Quoted-character sentinel collision (clist_getc returning TTY_QUOTE-flagged shorts): killed — TTY_QUOTE == 0x0100 (sys/sys/tty.h:208), stored values ≤ 0x1ff are always positive as int, so >= 0 loops (e.g. ttypend, tty.c:1665) and != -1 loops are equivalent.
• ccmax * sizeof(short) signed overflow for ccmax ∈ (2^30, 2^31): same unvalidated-ccmax root cause and same fix as known DF-0211 — folded into that finding's remediation, not re-filed.
• Info leak from clist_qtob/clist_getc: killed — every readable element is written by putc/btoq/alloc-copy; new buffers are M_ZERO (tty_subr.c:61).