DF-3637 — ath_tx_start() swallows ath_tx_normal_setup() failure: leaked ath_buf + descriptor slab, phantom TIM

What

sys/dev/netif/ath/ath/if_ath_tx.c:2081-2082 — ath_tx_start() stores the result of ath_tx_normal_setup() in r, jumps to done: on failure, but done: unconditionally return 0;. The failure is never propagated.

Consequence (source-level chain)

1. ath_tx_normal_setup() (if_ath_tx.c:1557) calls ath_tx_dmasetup() (if_ath_tx.c:294). On bus_dmamap_load* failure (ENOMEM with BUS_DMA_NOWAIT, or linearize/defrag failure under memory pressure) the mbuf is freed inside ath_tx_dmasetup() (if_ath_tx.c:320/338/349) and a non-zero error is returned. The "bogus frame type" branch (if_ath_tx.c:1706-1712) also frees the mbuf and returns EIO (reachable with an injected type-3 frame via the params==NULL raw path, which needs privileged BPF access).
2. ath_tx_start() sees r != 0, jumps to done:, returns 0.
3. The bf obtained by the caller (e.g. ath_raw_xmit() if_ath_tx.c:2407 ath_getbuf(); ath_transmit() in if_ath.c) is now: not queued anywhere, not returned to sc->sc_txbuf, mbuf already freed, bf_m never set. The caller believes TX succeeded: ath_raw_xmit() proceeds to set sc->sc_wd_timer = 5 and — worse — calls ath_tx_update_tim(sc, ni, 1) (if_ath_tx.c:2444), marking the power-save TIM for the node even though nothing is queued.
4. Each occurrence permanently leaks one ath_buf plus its private block of ATH_MAX_SCATTER(10) DMA descriptors (allocated 1:10 in ath_desc_alloc(), if_ath.c:3813-3816) and its bus_dmamap. ATH_TXBUF is a fixed pool (~500); exhaustion wedges TX on the interface (persistent local/remote-assisted DoS under memory pressure).

Reachability

Requires an ath(4) interface and either (a) bus_dmamap_load_mbuf* NOWAIT failure — attacker-assistable by driving the system into mbuf/DMA-map pressure while aggregated TX retries clone buffers — or (b) an injected 802.11 frame with FC type bits 3 via the legacy raw path (needs write access to /dev/bpf on a monitor vap, i.e. root). Guest has no ath hardware — runtime reproduction is impossible here; this pack carries the source-level proof instead.

How to verify (what run.sh does)

verify_df3637.py walks the exact cited lines in the read-only sys/ tree and asserts: (1) r = ath_tx_normal_setup(...) is followed by if (r != 0) goto done;; (2) the done: label returns literal 0; (3) every error return of ath_tx_dmasetup frees the mbuf first. Exit 0 == defect confirmed at source level.

Files

• verify_df3637.py — source-level verification script (the "PoC")
• run.sh — runs it, tees to run.log
• run.log — decisive output
• env.txt — audit-host + guest environment
• VERDICT.md — full narrative
• fix.diff — the one-line fix, never applied to sys/
• verdict.json / manifest.json

DF-3637 — ath_tx_start() swallows ath_tx_normal_setup() failure

REPRODUCED: No — not at runtime. The DragonFly audit guest (6.5-DEVELOPMENT X86_64_GENERIC, vtnet0/lo0 only) has no Atheros PCI/USB hardware; if_ath is compiled in but no device attaches (dev.ath sysctl tree absent, no wlan interfaces). The TX software-queue engine cannot be exercised on this machine, so the honest runtime verdict is not_reproduced with hardware-absent recorded in env.txt.

CONFIRMED: Yes — at source level, 8/8 assertions (run.log):

1. ath_tx_start() (sys/dev/netif/ath/ath/if_ath_tx.c:1866) stores the result of ath_tx_normal_setup() in r at if_ath_tx.c:2021.
2. On failure (r != 0) it jumps to done: (if_ath_tx.c:2023-2024) which unconditionally return 0; (if_ath_tx.c:2081-2082) — the error is discarded.
3. Every failure mode inside ath_tx_normal_setup()/ath_tx_dmasetup() that can produce r != 0 has already freed the caller's mbuf (if_ath_tx.c:320, 338, 349, 356, 1599, 1711) — so the mbuf is not leaked, but the ath_buf obtained by the caller IS: * ath_raw_xmit() grabs bf = ath_getbuf(sc, ATH_BUFTYPE_MGMT) at if_ath_tx.c:2407 and only returns it via goto bad2 when it sees a non-zero return (if_ath_tx.c:2422-2425). With the swallowed error it takes the success path: sets sc->sc_wd_timer = 5, calls ath_tx_update_tim(sc, ni, 1) (if_ath_tx.c:2444) — asserting a TIM for a node with nothing queued — and returns 0. * ath_transmit() (if_ath.c) has the same success/failure contract.
4. Each leaked ath_buf permanently removes one buffer plus its private 10-descriptor slab (ATH_MAX_SCATTER=10 per buffer, ath_descdma_setup(..., ath_txbuf, ATH_MAX_SCATTER) at if_ath.c:3813-3816) and its bus_dmamap from the fixed pools. Sustained failure (bus_dmamap_load NOWAIT ENOMEM under memory pressure — attacker-assistable by mbuf/cluster pressure against an associated peer — or a type-3 injected frame on the privileged legacy raw path, if_ath_tx.c:1706-1712) drains sc->sc_txbuf until _ath_getbuf_locked returns NULL (ast_tx_nobuf) and the interface can no longer transmit: a persistent wedge requiring reset.

EXPLOIT CHAIN: none (no memory corruption; resource-exhaustion DoS class). Local or remote-assisted (association + memory pressure) on hosts with ath(4) hardware.

WHY NOT A FALSE POSITIVE: the control flow is machine-verified (verify_df3637.py, 8/8 PASS); FreeBSD history keeps the same done: return 0; — this is an upstream-inherited defect, not a DragonFly-only artifact.

FIX VALIDATION: not_testable — requires ath(4) hardware to observe the pool drain. fix.diff is the trivially-correct one-liner (return r;); both paths reaching done: carry the intended value (r==0 on success).

Files: verify_df3637.py, run.sh, run.log, env.txt, fix.diff, verdict.json, manifest.json, README.md

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.