1-byte use-after-free read in iwi_frame_intr(): frame->rate read at :1353 from the old rx mbuf after ieee80211_input() consumed/freed it (softled enabled by default)

DF-3840 — if_iwi(4) 1-byte use-after-free READ in iwi_frame_intr(): frame points into the old rx mbuf; the mbuf is handed to ieee80211_input() which consumes/frees it (drop paths free synchronously); afterwards the driver reads frame->rate (if_iwi.c:1353) with softled enabled (default: sc->sc_softled = 1, if_iwi.c:3622).

WHAT TO LOOK AT trigger.c documentation harness with the exact call chain. VERDICT.md line-by-line trace incl. the net80211 free sites. fix.diff capture frame->rate before the handoff.

BUILD cc -O2 -o trigger trigger.c (compiles clean on the guest) RUN ./trigger (stub: hardware-gated path) EXPECT On hardware (iwi NIC associated, hw.iwi?.softled=1): every received DATA frame that ieee80211_input drops synchronously makes the driver read 1 byte of a freed mbuf cluster. Observable with a watchpoint on the cluster free. Guest: builds only.

FAMILY none — new in pass 2 (DF-1239/1240/1241 are different bugs).

DF-3840 VERDICT — status: inconclusive (hardware-gated), source-level: CERTAIN

Line-by-line trace (sys/dev/netif/iwi/if_iwi.c): 1632-1652 iwi_rx_intr(): hdr = mtod(data->m, struct iwi_hdr ); iwi_frame_intr(sc, data, idx, (struct iwi_frame )(hdr + 1)); -> frame points INTO data->m's mbuf cluster. 1314-1315 iwi_frame_intr(): m = data->m; data->m = mnew; (swap; m is the old mbuf, frame still points into it) 1324 rssi = frame->rssi_dbm; (safe — before the handoff) 1335 IWI_UNLOCK(sc); 1337-1342 ni = ieee80211_find_rxnode(...); type = ieee80211_input(ni, m, ...); or ieee80211_input_all(ic, m, ...); net80211 CONSUMES m. Drop paths free it synchronously: sys/netproto/802_11/wlan/ieee80211_input.c:169, :211, :245 (m_freem(m)); delivered frames are queued to netisr and freed shortly after. 1344 IWI_LOCK(sc); 1345 if (sc->sc_softled) { <- default 1 (if_iwi.c:3622) 1352 if (type == IEEE80211_FC0_TYPE_DATA) 1353 sc->sc_rxrate = frame->rate; <-- READ AFTER FREE

Impact: 1-byte read of freed (or about-to-be-freed) mbuf cluster memory, executed on every softled-enabled data-frame receive that input drops. The value only selects an LED blink-rate table index (if_iwi.c:3511-3567) — no direct disclosure path; this is a correctness/lifetime defect (CWE-416) that reads stale/reallocated memory and, in the delivered-frame case, races the netisr free. Severity Low, confidence certain (the code order is unambiguous).

Why not reproduced: guest has no Intel 2200BG/2915ABG NIC (run.log: "iwi_ifaces_rc=1", no iwi in ifconfig -l). The stub compiles clean (build.log).

Fix: fix.diff — snapshot rx_rate = frame->rate before IWI_UNLOCK and use the snapshot at :1353. Fix validation: not possible on this guest — fix_status not_applicable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.