DF-3594 — bwn_intr_noise re-entry after sample collection completes → 4-byte OOB write past noi_samples into mac_phy (or KASSERT panic)

Build / Run / Expected

# on the DF guest, as root:
sh probe.sh

Guest result: driver resident, no Broadcom hardware → runtime inconclusive. On a BCM43xx (G-PHY) machine whose firmware raises an extra BWN_INTR_NOISESAMPLE_OK after the 8-sample window closed (spurious/stale interrupt, or a malicious card), the expected observation:

• INVARIANTS kernels: panic: kassert "/sys/dev/netif/bwn/bwn/if_bwn.c:5198: fail"
• non-INVARIANTS kernels: silent 4-byte out-of-bounds write at mac->mac_noise.noi_samples[8][0..3] — past the [8][4] array into struct bwn_phy mac_phy (if_bwnvar.h:576-580, :917-918) — corrupting mac_phy.type/rev/analog with RSSI-LUT bytes influenced by the received signal, leading to subsequent misbehavior/panic in PHY dispatch.

VERDICT — DF-3594

Status: inconclusive at runtime (no bwn hardware on the audit guest); defect source-certain. Impact: panic (INVARIANTS) / 4-byte intra-object OOB write into struct bwn_phy (non-INVARIANTS).

Root cause (path:line)

bwn_intr_noise() (sys/dev/netif/bwn/bwn/if_bwn.c:5181-5230) runs on every BWN_INTR_NOISESAMPLE_OK:

1. The noise-sampling state machine: bwn_task_30s() (:6794-6804) sets noi_running = 1; noi_nsamples = 0 and requests a sample (bwn_noise_gensample :5409-5418).
2. Each interrupt appends: i = mac->mac_noise.noi_nsamples; (:5200), mac->mac_noise.noi_samples[i][0..3] = … (:5205-5208), noi_nsamples++ (:5209). When the count reaches 8 the driver computes the average and terminates sampling: noi_running = 0; (:5225) — but the sample-interrupt is never masked off: BWN_INTR_NOISESAMPLE_OK is part of BWN_INTR_MASKTEMPLATE (sys/dev/netif/bwn/bwn/if_bwnreg.h:324-328, installed as mac_intr_mask at if_bwn.c:2137 and re-enabled at the end of every bwn_intrtask at :5023), and bwn_intrtask invokes bwn_intr_noise() whenever the bit is set (:4997-4998).
3. There is no noi_running / noi_nsamples < 8 runtime guard at function entry (:5189-5200): only KASSERT(mac->mac_noise.noi_running) (:5192) and KASSERT(noi_nsamples < 8) (:5198-5199), which are compiled out of non-INVARIANTS kernels and are panics rather than guards on INVARIANTS ones.
4. A ninth invocation (stale/spurious firmware interrupt — same duplicate-reporting behavior the driver documents for TX-done at :7088-7091, or a malicious card raising the bit) with noi_nsamples == 8 executes noi_samples[8][j] = (:5205-5208).

struct bwn_noise ends with int8_t noi_samples[8][4] (sys/dev/netif/bwn/bwn/if_bwnvar.h:576-580) and is immediately followed by struct bwn_phy mac_phy inside struct bwn_mac (if_bwnvar.h:917-918) — the mac object is a single kmalloc(sizeof(*mac)) (if_bwn.c:586). The write lands on mac_phy.type/rev/analog (if_bwnvar.h:442-445) with values pg_nrssi_lt[clamped rssi byte] — firmware-controlled, RF-influenced data. PHY type corruption feeds later dispatch (bwn_rate_init :2402, bwn_set_opmode, PHY op pointer selection at attach is already done — so this mostly yields wrong-code-path panics rather than a controlled hijack; honest impact: kernel-memory corruption with limited control, realistic outcome panic).

Why runtime reproduction was not possible

Same as DF-3593: virtio-only guest, no BCM43xx card (run.log). The G-PHY noise-sample interrupt cannot be raised. No uid0 chain — the write offset is fixed (+32 bytes into mac_phy) and the value domain is a 64-entry RSSI LUT.

Fix

Early-return unless the state machine expects a sample — see fix.diff.

Artifacts

• probe.sh, run.log — guest probe (driver residency + hardware absence)
• fix.diff — proposed patch vs read-only sys/ tree (never applied)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.