DF-3671 — ixgbe_common.c: unchecked PHY/EEPMD read returns feed config decisions from uninitialized/zeroed state

File: sys/dev/netif/ix/ixgbe_common.c · Severity: Info (hardening; DF-3643 parity) · Class: error-handling discipline

Sites (all upstream-identical vendored shared code; no divergence found)

1. ixgbe_clear_hw_cntrs_generic ixgbe_common.c:621-628 — four hw->phy.ops.read_reg(..., &i) calls with discarded return values (X540/ X550 path). On failure nothing is decided from them (results unused), so impact is nil here; included for completeness.
2. ixgbe_set_lan_id_multi_port_pcie :1095 — hw->eeprom.ops.read(hw, IXGBE_EEPROM_CTRL_4, &ee_ctrl_4) unchecked; on failure ee_ctrl_4 is an uninitialized stack u16 used to derive bus->instance_id (CS4227 MAC instance selection) — config from garbage.
3. ixgbe_setup_fc_generic :278-279 — copper path reads the PHY AN advertisement with the return discarded; reg_cu stays 0 and is then written back to IXGBE_MDIO_AUTO_NEG_ADVT at :375-376 after OR-ing in pause bits — a failed read turns into a PHY register clobber that silently drops all non-FC advertisement bits (link renegotiation breakage).
4. ixgbe_fc_autoneg_copper :3083-3088 — two unchecked PHY reads whose (zero-initialized) results feed ixgbe_negotiate_fc; zero inputs happen to be rejected there (!(adv_reg) check at 2953), so failure degrades to fc_none instead of an explicit error — silent misconfiguration.
5. ixgbe_get_device_caps_generic :4438 — unchecked EEPROM read; the caller ixgbe_start_hw_generic (:397/:430-431) passes the address of an uninitialized stack u16 and then tests device_caps & IXGBE_DEVICE_CAPS_NO_CROSSTALK_WR — the crosstalk-fix decision (hw->need_crosstalk_fix) is made from uninitialized kernel stack memory.

No path returns these values to userspace, so this is a correctness/hardening defect, not a leak — same classification as DF-3643 (Info).

PoC / verification

Hardware-gated (PHY/EEPROM read failures need a malfunctioning or malicious NIC/PHY). No runnable PoC; guest has no ixgbe device (env.txt). fix.diff checks all five return values (device_caps zero-initialized + error propagation, PHY reads bailing with IXGBE_ERR_PHY, skipped write-back on failed read) and compile-validates on the guest's md5-identical source (build_patched.log, -Werror clean).

DF-3671 — VERDICT

Status: inconclusive (runtime) / source-level certain. Severity Info: no kernel-memory disclosure, decisions-only uninitialized/garbage inputs. DF-3643 parity for the ixgbe HAL.

Analysis

The e1000_ich8lan pass-1 lesson (DF-3643: "Unchecked PHY-read return values: EEE decisions and PHY write-backs derived from uninitialized kernel stack") applies verbatim to five clusters in the ixgbe shared code; none of them propagates the read status:

Reachability: all execute during ix_start_hw/ix_setup_fc/ix_init — i.e., attach and every interface init on real ixgbe hardware. The reads fail when the PHY/MDIO bus is wedged, during overtemp resets, or under a hostile PHY — precisely the states where making config decisions from garbage compounds the fault.

Impact ceiling: wrong flow-control negotiation, broken link advertisement (site 3 actively corrupts PHY state), wrong crosstalk-fix enablement. No userspace-visible memory disclosure → Info, matching DF-3643.

Upstream fidelity

Function-level diffs against FreeBSD head shared code (ixgbe_fc_autoneg_copper, ixgbe_setup_fc_generic) came back IDENTICAL for these sites — FreeBSD carries the same pattern; this is vendored-code divergence logging (fix owner: Intel shared code), filed for completeness and for the local hardening patch.

Verification performed

Source walk only + fix compile validation (fix.diff adds return-value checks; build_patched.log -Werror clean on the guest's md5-identical /usr/src). Runtime reproduction requires a failing PHY on real hardware — absent on this guest (env.txt). Guest source restored; guest left clean.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.