DF-3664 — bge_nvram_getbyte leaks NVRAM SWARB lock + access-enable on error paths

Build / Run / Expected

./build.sh          # cc -O -Wall -o trigger trigger.c   (in a DragonFly guest)
./run.sh            # runs the trigger + records the guest-side reachability proof

Expected on real BCM5906 hardware (NOT available in this environment): an NVRAM read that times out (grant timeout at if_bge.c:557 or read-done timeout at if_bge.c:574) returns while BGE_NVRAMSWARB_SET1 is still latched and BGE_NVRAMACC_ENABLE is still set; the flash arbiter stays held by the driver for its lifetime, starving ASF/management firmware of NVRAM access. Device-side functional DoS only — no host memory-safety impact.

Actual on the audit guest: no Broadcom PCI device exists (virtio-net only), so bge_attach/bge_nvram_getbyte are unreachable — the trigger builds clean and prints its hardware-precondition notice (run.log). Verification is therefore honestly inconclusive (source-visible asymmetry; see VERDICT.md).

Files

• trigger.c — annotated hardware-precondition trigger
• run.log — guest proof: pci/if_bge compiled into the kernel, NO_BROADCOM_DEVICE, sysctl hw.bge unknown, /usr/src md5 == audited tree, clean build, trigger output
• fix.diff — git-apply-able release/restore on both error paths (mirrors the paired success-path cleanup at if_bge.c:584-589)
• verdict.json / manifest.json — machine verdict

DF-3664 VERDICT — bge_nvram_getbyte leaks the NVRAM arbiter on error paths

Status: INCONCLUSIVE at runtime (no bge hardware — and specifically no BCM5906 — on the audit guest); source-level CERTAIN (visible asymmetry).

Root cause

bge_nvram_getbyte() — sys/dev/netif/bge/if_bge.c:544-592 — performs the NVRAM software-arbitration handshake:

551:  CSR_WRITE_4(sc, BGE_NVRAM_SWARB, BGE_NVRAMSWARB_SET1);       /* REQUEST */
552:  for (i = 0; i < 8000; i++) {
553:      if (CSR_READ_4(sc, BGE_NVRAM_SWARB) & BGE_NVRAMSWARB_GNT1)
554:          break;
555:      DELAY(20);
556:  }
557:  if (i == 8000)
558:      return (1);                  /* BUG #1: request still latched —
                                         no BGE_NVRAMSWARB_CLR1 ever written */
561:  access = CSR_READ_4(sc, BGE_NVRAM_ACCESS);
562:  CSR_WRITE_4(sc, BGE_NVRAM_ACCESS, access | BGE_NVRAMACC_ENABLE);
565:  CSR_WRITE_4(sc, BGE_NVRAM_CMD, BGE_NVRAM_READCMD);
566:  for (i = 0; i < BGE_TIMEOUT * 10; i++) { ... }
574:  if (i == BGE_TIMEOUT * 10) {
575:      if_printf(&sc->arpcom.ac_if, "nvram read timed out\n");
576:      return (1);                  /* BUG #2: SWARB lock STILL HELD and
                                         BGE_NVRAMACC_ENABLE left set */
      }
...
585:  CSR_WRITE_4(sc, BGE_NVRAM_ACCESS, access);        /* paired cleanup */
588:  CSR_WRITE_4(sc, BGE_NVRAM_SWARB, BGE_NVRAMSWARB_CLR1);  /* paired */

The success path is paired (584-589) — this is the e1000/bnx-audit discipline the orchestrator asked to verify, and it holds for the normal path. The two timeout paths return without either releasing the arbitration request or restoring the access register.

Reachability

bge_read_nvram() only proceeds for sc->bge_asicrev == BGE_ASICREV_BCM5906 (if_bge.c:603-604); it is called at attach time by bge_get_eaddr_nvram() (if_bge.c:4977-4985) as the second station-address source. One NVM read-done or grant timeout during attach therefore leaves the arbiter held for the driver's whole lifetime.

Impact

Device-side functional denial of service only: after a timeout (i.e. on already-malfunctioning hardware) other NVRAM masters — ASF/management firmware, other agents sharing BGE_NVRAM_SWARB — can no longer arbitrate for the flash, and the NVRAM access window stays enabled. No host memory-safety impact, no unprivileged trigger. Contrast the bnx sibling DF-3640 (bnx_reset never released, filed Low): bge's defect is strictly weaker (error paths only), hence Info here.

Verification attempt (honest)

Audit guest: pci/if_bge compiled into the kernel (kldstat -v id 59) but pciconf -l shows NO_BROADCOM_DEVICE (virtio-net only) and sysctl hw.bge is an unknown oid — attach never runs, so neither the bug nor the fix is exercisable. Guest /usr/src if_bge.c md5 f6c2d771384a52775cd4bb399d5dcab1 == audited tree (run.log).

Fix validation

fix.diff adds the missing cleanup on both error paths, mirroring the paired success-path idiom (restore BGE_NVRAM_ACCESS, then BGE_NVRAMSWARB_CLR1 + flush read; for the grant-timeout path only the request drop, since access is not yet saved). git apply --check passes against the pristine tree. Runtime baseline-vs-patched comparison impossible for the hardware reason (fix_status: not_testable).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.