DF-3643 — unchecked PHY-read return values: decisions and PHY write-backs on uninitialized stack variables

What / where

sys/dev/netif/ig_hal/e1000_ich8lan.c — several PHY register reads ignore the hw->phy.ops.read_reg* return value and then use (and write back) the destination variable, which is an uninitialized stack u16 when the read fails:

On read failure the PHY was not written, so the variable keeps whatever was on the kernel stack; the code then writes that garbage (partially masked) into PHY analog/config registers or bases an EEE enable decision on it.

Reachability

• e1000_check_for_copper_link_ich8lan runs from the link-status interrupt / watchdog path on every link event on PCH hardware (mac.ops.check_for_link).
• e1000_set_eee_pchlan runs after every link-up for 82579/I217 PHYs (e1000_ich8lan.c:1784-1788).
• e1000_lv_jumbo_workaround_ich8lan runs on MTU changes to >1500 (if_em ioctl path).

A read failure is the precondition (PHY in reset/MDIO error/SMBus-mode transition) — on healthy hardware rare; on failing or malicious hardware inducible.

Impact

Uninitialized-kernel-stack-influenced PHY configuration (register write-backs of stack garbage under masks). The value is never copied to userspace, so there is no direct info leak; the outcome is a mis-programmed PHY (link instability at worst) and a KMSAN-class uninitialized-read defect. Severity: Info (hardening).

Reproduce (source-level)

sh findings/poc/DF-3643/trace.sh        # regenerates trace.log with all cited lines
git apply --check findings/poc/DF-3643/fix.diff

Runtime reproduction requires Intel PCH GbE PHY hardware whose MDIO reads can be made to fail; the audit guest has only virtio NICs (see guest_env.txt), so the defect is proven at source level; identical code exists in FreeBSD HEAD (upstream-inherited).

Expected result after fix

Failed PHY reads abort the EEE decision (goto release), return an error from the link-check path, or conservatively use 0-initialized values for RMW chains, so no decision or write-back is derived from uninitialized stack.

VERDICT — DF-3643

Status: not_reproduced (runtime) — defect certain (source), upstream-inherited.

What I did

1. Enumerated every hw->phy.ops.read_reg* call site in the file whose return value is discarded and whose destination is consumed afterwards. The five clusters above (trace.log) are the complete set; all other read sites either check the return or do not use the destination on the error path.
2. Confirmed each destination is genuinely uninitialized at first use on the failing path (data decl. 909, phy_reg decl. 1552 / 2761) — these are per-call stack frames, so on repeated watchdog invocations the slot contains stale data from the previous call or arbitrary caller frames, i.e. non-deterministic kernel-stack content flows into PHY register writes.
3. Verified the code is byte-identical in FreeBSD HEAD (upstream-inherited) and that DragonFly's copy is a faithful vendor snapshot (diff vs FreeBSD stable/12 contains no local edits to these functions).
4. Guest verification (guest_env.txt): no Intel GbE MAC on the QEMU guest (virtio only), so the PHY paths never execute there; runtime reproduction is impossible on this rig. Deterministically forcing read_reg failures requires real (or emulated-FPGA) PHY hardware.

Impact ceiling (honest)

• No kernel memory corruption, no userspace info leak (values are only written into PHY config registers and used in branches).
• Worst realistic outcome: garbage analog/clock-gate/FIFO config written to the PHY while it is in an error state — link flaps/instability, i.e. a robustness defect more than a security boundary crossing. KMSAN would flag every site.
• Classified Info (hardening) per the audit rubric.

Fix

fix.diff (git-apply-able, git apply --check verified): check the return of the PHY_LP_ABILITY read (EEE decision aborts to release), check the HV_KMRN_FIFO_CTRLSTA read (error returned to the link-check caller), check the PHY_REG(769,20) jumbo Rx-disable read, and zero-initialize the RMW chain locals so any remaining unchecked read degrades to defined defaults. Fix validation on hardware was not possible on this guest (fix_status: not_testable).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.