DF-3879 — dsp_mmap_single() negative-offset bounds bypass + u32 truncation

File: sys/dev/sound/pcm/dsp.c:2296-2364 — pass 2 (GLM 5.3), kernel-path verified 2026-09-16 (GLM 5.3 verify pass).

THE BUG (mechanism corrected during verification): vm_ooffset_t is SIGNED (sys/cpu/x86_64/include/types.h:44), and kern_mmap() performs no sign/range validation of the mmap offset for VCHR devices (vm_mmap.c:195-197). dsp_mmap_single()'s only bound

(*offset + size) > sndbuf_getsize(c->bufsoft)        dsp.c:2342

therefore passes for a NEGATIVE offset (off = t - size, t in [0,bufsize)): the sum lands in [0, bufsize]. The offset is then truncated to unsigned int ofs by sndbuf_getbufofs() (dsp.c:2355, buffer.c:424-429, KASSERT-only bound) and the resulting wild kernel pointer b->buf + ofs becomes the device-pager offset (dsp.c:2357).

MAKING THE GUEST ATTACKABLE (QEMU audio attach) The audit guest boots headless with no sound hardware. Boot it with:

    -audiodev none,id=snd0 \
    -device intel-hda -device hda-duplex,audiodev=snd0

(see the run narrative in run.log; dfbsd-qemu/vm.sh was NOT modified —
a temporary launcher added the three flags). In the guest:

    kldload snd_hda        # binds QEMU ICH6 HDA (8086:2668)

dmesg then shows hdac0/hdacc0/hdaa0/pcm0 and /dev/dsp + /dev/dsp0
appear 0666 root:wheel (env.audio.txt).

BUILD (on the guest) cc -O2 -Wall -o /tmp/mmap_ofs /tmp/mmap_ofs_overflow.c cc -O2 -Wall -o /tmp/mmap_alias_rw /tmp/mmap_alias_rw.c cc -O2 -Wall -o /tmp/sanity_mmap /tmp/sanity_mmap.c

RUN (unprivileged, e.g. vm.sh run_user) /tmp/mmap_ofs; echo exit=$?

EXPECTED — stock INVARIANTS kernel (e.g. X86_64_GENERIC) * variant B (/tmp/mmap_ofs, off=0xffffffff10000000 size=0xf0000000): the ssh session dies mid-run and the serial console shows panic: sndbuf_getbufofs: ofs invalid 268435456 with backtrace kern_mmap -> vm_mmap -> dev_dmmap_single -> dsp_mmap_single -> sndbuf_getbufofs (panic.txt). 268435456 = 0x10000000 = the attacker-chosen ofs. * variant A (/tmp/mmap_alias_rw, off=0xffffffff00000000 size=4GiB): Fatal trap 12 in pmap_kextract during the mmap syscall (panic.pmap.txt) — the device-pager ctor walk over the wild range; contains NO INVARIANTS code, so this fires on production builds too. On a NON-INVARIANTS kernel variant B proceeds into the pager: with a heap-layout-dependent mapped victim page in [b->buf+4GB-S, b->buf+4GB) the mapping succeeds and aliases that kernel page RW (uid=0 ceiling; see VERDICT.md "attack geometry" — not demonstrated on this guest).

EXPECTED — kernel with fix.diff (v2) applied variant B: mmap: Invalid argument (errno=22), exit=0, guest up variant A: wild mmap: Invalid argument, guest up sanity: legit mmap(off=0, size=bufsize=65536) ok, RW verified

FIX VALIDATION (kernel-level) cd /usr/src && git apply fix.diff make -j6 nativekernel KERNCONF=X86_64_GENERIC (~30 min) install the REBUILT sound.ko module (dsp.c lives in the module, not the kernel binary!) from /usr/obj/usr/src/sys/X86_64_GENERIC/usr/src/sys/dev/sound/sound/sound.ko to /boot/kernel/sound.ko (+ matching snd_hda.ko from .../driver/hda/), sync, reboot, re-run the matrix above. NOTE: the originally-filed v1 fix (signed compares) was built and PROVEN INSUFFICIENT — variant B still panicked; only the v2 unsigned-compare form blocks the attack.

ARTIFACTS mmap_ofs_overflow.c the filed PoC (panic trigger, variant B) mmap_alias_rw.c negative-offset pager proof (variant A/A2) mmap_onepage.c small-S attack shape (RW-alias follow-up) kmemprobe.c root-side /dev/kmem mapped-ness oracle sanity_mmap.c legit-feature regression check panic.txt KASSERT panic + backtrace (stock kernel) panic.pmap.txt pmap_kextract fatal trap (stock kernel) run.log narrative of all runs env.audio.txt audio-enabled guest environment fix_*.log/txt fix validation evidence fix.diff v2 fix (authoritative; kernel-validated) verdict.json / manifest.json / VERDICT.md

DF-3879 VERDICT — dsp_mmap_single offset-overflow → wild kernel page mapping

Status: REPRODUCED on the live kernel (impact: panic — deterministic, unprivileged; twice, with two distinct signatures). Fix validated (v2).

2026-09-16 verification update (GLM 5.3 verify pass): the kernel path was made executable by attaching QEMU emulated audio (-device intel-hda -device hda-duplex with -audiodev none) to the audit guest; DragonFly's snd_hda.ko binds the QEMU ICH6 HDA controller (8086:2668) and the hda-duplex codec (0x1af40022), creating pcm0 (play/rec) and /dev/dsp, /dev/dsp0 — both 0666 root:wheel (dsp.c:2506-2509, sound.c:1420-1425). Every hardware precondition of the finding is now met on this guest; see env.audio.txt.

Verification results (all runs as unprivileged uid=1001 via /dev/dsp)

1. Variant B — the filed PoC (mmap_ofs_overflow), off=0xffffffff10000000 size=0xf0000000: deterministic panic during the mmap(2) syscall, serial console (panic.txt):

   panic: sndbuf_getbufofs: ofs invalid 268435456 sndbuf_getbufofs() at sndbuf_getbufofs+0x2b dsp_mmap_single() at dsp_mmap_single+0x149 dev_dmmap_single() at dev_dmmap_single+0x5e vm_mmap() at vm_mmap+0x6d8 kern_mmap() at kern_mmap+0x378

268435456 = 0x10000000 = exactly the attacker-chosen ofs — the complete chain of the finding executed on the running kernel.

2. Variant A (mmap_alias_rw), off=0xffffffff00000000 (= −2^32) size=0x100000000: the check at dsp.c:2342 passes (sum = 0 ≤ bufsize), the wild offset is installed in the device pager, and the kernel panics inside the mmap syscall in pmap_kextract (panic.pmap.txt):

   Fatal user address access from kernel mode from mmap_alias_rw Fatal trap 12: page fault while in kernel mode fault virtual address = 0xffff80403e005000 (DMAP read of a garbage PDE target ≈ phys 275GB) Stopped at pmap_kextract.part.23+0x16: movq (%rax,%rdx,1),%rdx

Mechanism (source-proven, device_pager.c old_dev_pager_ctor): the old-style cdev pager ctor validates EVERY page of the mapping upfront (for (off = foff; npages--; off += PAGE_SIZE) dev_dmmap(...)), and dsp_mmap never returns -1, so a mapping whose range leaves mapped KVA makes vtophys() walk garbage page-table entries — an unrecoverable kernel page fault. This path contains zero INVARIANTS-dependent code — it fires identically on production (non-INVARIANTS) builds. Deterministic across boots (same fault VA twice: phys page 0 content is boot-identical).

CORRECTION to the filed mechanism (important)

The filed framing "u64 wrap" is imprecise: vm_ooffset_t is SIGNED (typedef __int64_t vm_ooffset_t, sys/cpu/x86_64/include/types.h:44). The attack offset 0xffffffff10000000 IS -0xF0000000 as int64 — the user simply passes a negative mmap offset (t - size), which kern_mmap never range-checks for VCHR (vm_mmap.c:195-197 page-aligns only), and the signed sum *offset + size = t ∈ [0, bufsize] passes dsp.c:2342 without any 2^64 modular wrap. All PoC numbers, both panics, and the u32 truncation sink ((unsigned int)(-0xF0000000) = 0x10000000) are unchanged; only the type analysis is corrected.

Attack geometry (refined): with mmap size S, a true negative offset requires t ∈ [0, min(bufsize, S)) and yields ofs = (u32)(t - S) = 2^32 - S + t → wild = b->buf + 2^32 - S + t, i.e. the aliasable window is [b->buf + 4GB - S, b->buf + 4GB) and the pager ctor must validate every one of the S/PAGE pages. Small S (1 page) gives a one-page alias target at b->buf + 0xFFFFF000+t; whether that page is mapped KVA is heap-layout dependent (kernel_map band 0xfffff800_00000000+, kstacks observed at 0xfffff801_1xxxxxxx). Misses panic deterministically (the RUN-1/2 primitive); hits give the RW alias. A full RW-alias demonstration on this guest would need a root-side /dev/kmem mapped-ness oracle to pre-select t (kmemprobe.c in this pack) — left as follow-up; the panic reproduction above already proves the check bypass, the wild offset reaching the pager, and the vtophys/pmap_kextract sink live.

Fix validation — v1 INSUFFICIENT, v2 VALIDATED

• v1 (the originally-filed *offset > sndbuf_getsize(...) || size > sndbuf_getsize(...) - *offset) compiles but does NOT block the attack: because vm_ooffset_t is signed, *offset > bufsize is a signed compare (jg in the objdump) — a negative offset is "not greater" — and size > bufsize - *offset computes 0xF0000000 > 0xF0010000 = false. Verified empirically: the v1 module was built, installed, and variant B still panicked* with the same KASSERT signature. This is a textbook example of why fix validation must be executed, not reviewed.

• v2 (validated): compare unsigned —

  (uint64_t)offset > (uint64_t)sndbuf_getsize(c->bufsoft) || size > (uint64_t)sndbuf_getsize(c->bufsoft) - (uint64_t)offset ||

objdump of the built sound.ko shows ja/jb (unsigned) at both compares. Full matrix on kernel #1 + fixed sound.ko (fix_env.txt, fix_run_variantB.log, fix_run_variantA_sanity.log):

Build: make nativekernel KERNCONF=X86_64_GENERIC (kernel #1, 19:37), fixed sound.ko (md5 6f5280a1ded4e7b516549eefdc8f1735) installed to /boot/kernel (fix_build.log). Note dsp.c lives in the sound.ko module, not the kernel binary — validation requires the rebuilt module, not just a kernel rebuild.

Root cause (as filed, line-verified)

1. Unvalidated offset in. kern_mmap() page-aligns the user's mmap offset but performs NO range/sign validation of pos for VCHR mappings (sys/vm/vm_mmap.c:195-197), and vm_mmap() hands it straight to dev_dmmap_single() (vm_mmap.c:1377, kern_device.c:286-310) — any 64-bit page-aligned value, negative included, reaches dsp_mmap_single().

2. Wrapping bounds check. The only bound is (*offset + size) > sndbuf_getsize(c->bufsoft) — dsp.c:2342: choosing *offset = t - size (t ∈ [0, bufsize]) makes the sum t ≤ bufsize and the check PASSES. Reproduced live (both variants).

3. 32-bit truncation. *offset = (uintptr_t)sndbuf_getbufofs(c->bufsoft, *offset) — dsp.c:2355; the callee takes unsigned int ofs (buffer.c:424-429) and its ONLY bound is KASSERT(ofs < b->bufsize) — compiled out on production kernels, and on INVARIANTS kernels a panic primitive (proven: panic.txt). With the check bypassed, ofs ∈ [bufsize, 4GB) is fully attacker-chosen.

4. The wild pointer becomes the pager offset. dev_pager_alloc(i_dev, size, nprot, *offset) — dsp.c:2357 creates an old-style cdev pager (device_pager.c:174-177). Its ctor validates each page by calling dev_dmmap() (device_pager.c:326-333) which lands in dsp_mmap() (dsp.c:2287-2294) — that function ALWAYS returns 0 with a_result = atop(vtophys(offset)), so ctor validation is a no-op even for wild addresses — proven live: the ctor walk itself panics in pmap_kextract (panic.pmap.txt). The vm_map entry is created with offset = wild (vm_mmap.c:1466-1471), and every page fault funnels old_dev_pager_fault (device_pager.c:351-363) → dev_dmmap(wild + n*PAGE) → dsp_mmap → vtophys(wild + n*PAGE) = pmap_kextract (pmap.c:1865-1890).

5. Physical page entered into user PTEs. pmap_kextract on a MAPPED wild kernel address returns its true physical frame — which dev_pager_getfake/pmap_phys_address enter into the user's mapping read/write (device_pager.c:355-390). On a NON-INVARIANTS kernel this is unprivileged arbitrary kernel-memory read/write within 4GB of the sound soft buffer (kernel heap spray → victim object → uid=0); reachability of a mapped victim page is heap-layout dependent (see "Attack geometry"). On an UNMAPPED wild address pmap_kextract walks garbage PTEs and the kernel takes an unrecoverable page fault (deterministic, reproduced — panic.pmap.txt; INVARIANTS-independent).

Reachability

• /dev/dsp and friends are created 0666 root:wheel* (dsp.c:2506-2509 make_only_dev(... 0666 ...)), so the surface is every local unprivileged user on any machine with a PCM device — including QEMU/KVM virtual machines with emulated HDA (this verification).
• Gates that pass trivially: channel must not be RUNNING/DEAD — CHN_F_MMAP_INVALID == (CHN_F_DEAD | CHN_F_RUNNING) (channel.h:402), so a freshly-opened /dev/dsp (before any write/trigger) is mmap-valid. PROT_READ alone selects rdch; PROT_WRITE selects wrch (dsp.c:2329-2340); open O_RDWR gives both. mmap must be MAP_SHARED (vm_mmap.c:309-313 rejects MAP_PRIVATE for VCHR) — matches the exploit requirement.
• bufsoft is allocated by the OSS setup ioctls (SETFMT/CHANNELS/SPEED → chn_setparam → chn_resizebuf → sndbuf_remalloc, channel.c:1954/1910) — bufsize 65536 observed; at fresh open bufsoft->buf is NULL (chn_init: sndbuf_setup(bs, NULL, 0), channel.c:1247) which merely changes the panic variant.

Severity note

Critical on non-INVARIANTS production builds with sound hardware (arbitrary kernel R/W within 4GB of the sound soft buffer → uid=0, gated on heap layout); deterministic local DoS by unprivileged users on INVARIANTS builds (KASSERT panic) AND on production builds (pmap_kextract page fault — INVARIANTS-independent, reproduced). /dev/dsp is 0666. CVSS reflects the worst case.

Fix

Reject the negative/wrapped offset with UNSIGNED comparisons — fix.diff (v2, git-apply clean, kernel-build-validated on the guest). v1's signed form was proven insufficient and superseded.

    if (c == NULL || (c->flags & CHN_F_MMAP_INVALID) ||
-       (*offset  + size) > sndbuf_getsize(c->bufsoft) ||
+       /* DF-3879: vm_ooffset_t is SIGNED (__int64_t): a negative
+        * *offset made the old (*offset + size) sum land within
+        * [0, bufsize]; sndbuf_getbufofs() then truncated it to
+        * unsigned int — wild kernel pointer into the device pager.
+        * Compare unsigned so negative offsets are rejected. */
+       (uint64_t)*offset > (uint64_t)sndbuf_getsize(c->bufsoft) ||
+       size > (uint64_t)sndbuf_getsize(c->bufsoft) - (uint64_t)*offset ||

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.