linesw[] registry accepts conflicting registrations and deregisters in-use disciplines with no validation — dual NETGRAPHDISC(6) registration by netgraph and netgraph7 tty modules silently aliases/strands live ttys

Summary

ldisc_register's explicit-index path never checks the target slot is free — it silently overwrites compiled-in discs or another module's live registration. ldisc_deregister never checks the discipline is unused and provides no use-count, so any unload path wipes linesw[n] while ttys still sit at t_line==n. Concrete collision: BOTH sys/netgraph/tty/ng_tty.c and sys/netgraph7/tty/ng_tty.c register NETGRAPHDISC=6 — loading both repoints linesw[6] to the second module while ttys opened through the first keep their old softc; unloading the first wipes the second's registration; and neither MOD_UNLOAD does any EBUSY check, so kldunload with a tty active on disc 6 strands it on nodisc (ENODEV), never runs its l_close, leaks the per-tty softc and netgraph node, and a subsequent kldload makes the stale tty dispatch into the fresh module with orphaned per-tp state. Root-triggered (kldload/kldunload) optionally racing unpriv TIOCSETD churn — impact ceiling is registry-state corruption, stranded ttys, kernel-memory leak, DoS of the slot; not a direct unprivileged memory-safety primitive (all module l_opens priv-check). Fix: occupied-slot rejection + use-count-gated deregister + ng modules using LDISC_LOAD instead of sharing index 6.

Timeline

• 2026-09-02 Discovered during pass-2 audit of tty_conf.c (GLM 5.3). DF-0244 re-verified still present, not re-reported.