DF-3638 — ath_tx_retry_clone() error path leaks the node reference and recycles a buffer with dangling bf_m

What

sys/dev/netif/ath/ath/if_ath_tx.c:4567-4583 — when the DMA-map reload of a cloned retry/filtered frame fails, the clone nbf is pushed back onto the free list while still owning the moved bf_node reference (never decref'd) and a bf_m pointer that dangles at the mbuf chain freed inside ath_tx_dmasetup().

Chain (source-level, machine-verified)

• ath_tx_retry_clone() is called for BUSY buffers during software retry of aggregate subframes (ath_tx_retry_subframe, if_ath_tx.c:4723) and filtered-frame handling (ath_tx_tid_filt_comp_single, if_ath_tx.c:3495).
• ath_buf_clone() (if_ath.c:3170) moves bf_m/bf_node into nbf (ownership transfer; original NULLed).
• ath_tx_dmasetup(sc, nbf, nbf->bf_m) fails (bus_dmamap_load NOWAIT ENOMEM / linearize failure under memory pressure) — the mbuf is freed inside dmasetup (if_ath_tx.c:320/338/349/356).
• Error path returns nbf to sc->sc_txbuf without decref'ing nbf->bf_node or clearing nbf->bf_m (if_ath_tx.c:4579-4581).
• _ath_getbuf_locked() (if_ath.c:3080) does not clear bf_m/bf_node on reuse → next consumer inherits the stale fields until a successful reload overwrites them.

Impact

• Permanent leak of one ieee80211_node + ath_node (≈ KBs each, incl. 17 TIDs, BAW tracking, rate state) per occurrence → slow station-slot/memory exhaustion (DoS) on hosts with ath(4) hardware under memory pressure.
• Latent use-after-free pointer field in a recycled kernel buffer (not dereferenced along current call graphs, but one refactor away from a real UAF; ath_tx_freebuf()'s bus_dmamap_unload on bf->bf_m != NULL is the nearest would-be sink).

Reachability

ath(4) interface + a bus_dmamap_load NOWAIT failure during retry-clone. Guest has no Atheros hardware (see env.txt) — runtime reproduction impossible; verify_df3638.py proves the control flow (8/8 PASS).

Files

verify_df3638.py (the PoC), run.sh, run.log, env.txt, VERDICT.md, fix.diff, verdict.json, manifest.json.

DF-3638 — ath_tx_retry_clone() error path: node-reference leak + recycled buffer with dangling bf_m

REPRODUCED: No — not at runtime (guest has no Atheros hardware; see env.txt). Honest verdict: not_reproduced, hardware-absent.

CONFIRMED: Yes — at source level, 8/8 assertions (run.log):

1. ath_tx_retry_clone() (sys/dev/netif/ath/ath/if_ath_tx.c:4539) clones a BUSY retry/filtered buffer: ath_buf_clone() (if_ath.c:3170) MOVES bf_m and bf_node (the held ieee80211_node reference) into nbf — an ownership transfer, no incref, and NULLs them in the original.
2. ath_tx_dmasetup(sc, nbf, nbf->bf_m) (if_ath_tx.c:4568) reloads the DMA map for the moved mbuf. On failure it frees the mbuf chain itself (if_ath_tx.c:320/338/349/356) and returns error.
3. The error path (if_ath_tx.c:4569-4583) then does ath_returnbuf_head(sc, nbf) and returns NULL — without dropping nbf->bf_node and without clearing nbf->bf_m (now dangling at the freed mbuf chain).
4. Consequences: * The moved node reference is never decref'd → the ieee80211_node + ath_node (with 17 ath_tid's, BAW arrays, rate-control state) is leaked permanently. Repeated failures (memory-pressure windows during aggregate retry/filter handling against a peer) leak one station each. * _ath_getbuf_locked() (if_ath.c:3080) sanitizes only bf_flags, bf_next, bf_last, bf_comp and bf_state on reuse — NOT bf_m/bf_node — so the recycled buffer carries a dangling mbuf pointer until a later successful ath_tx_dmasetup overwrites it. Any future consumer that reads bf->bf_m before a successful reload (or an error-path that unloads the map, e.g. ath_tx_freebuf's if (bf->bf_m != NULL) bus_dmamap_unload(...), if_ath.c:4888-4891) would operate on freed memory. With the current call graph the stale pointer happens to be overwritten before any such read, making this a latent use-after-free hazard and a hard reference leak today. * ath_freebuf() KASSERTs the invariant this path breaks (bf_node==NULL/bf_m==NULL at hand-in, if_ath.c:4849-4850) — release kernels compile the KASSERT out, hiding the contract violation.

EXPLOIT CHAIN: none — leak/DoS class (station-slot exhaustion, latent UAF pointer). Trigger requires ath(4) hardware and a bus_dmamap_load NOWAIT failure during retry-clone of a BUSY filtered/retried aggregate frame.

WHY NOT A FALSE POSITIVE: control flow machine-verified (8/8 PASS); inherited from FreeBSD's if_ath_tx.c (same error path upstream).

FIX VALIDATION: not_testable — no ath hardware on the guest. fix.diff detaches node/mbuf on the error path and additionally hardens _ath_getbuf_locked to clear bf_m/bf_node on every reuse (defense in depth, mirrors the existing KASSERT contract).

Files: verify_df3638.py, run.sh, run.log, env.txt, fix.diff, verdict.json, manifest.json, README.md

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.