DF-3996 — VERDICT

Finding: When a second same-direction channel starts on envy24(4), the DMA-emulator functions index the shared play/record DMA buffers with an unclamped dst = src/2 + ch->offset (play) / src = dst/2 + ch->offset (rec): the first loop iteration runs before the %= dsize wrap, writing/reading out of bounds whenever src/2 + offset >= dsize.

Status: reproduced (verbatim-code harness on the guest; live /dev/dsp trigger impossible — the QEMU guest has no ICE1712 hardware). Confidence: certain. Impact on real hardware: kernel heap corruption (controlled 32-bit writes up to ~82 KB past a 160 KB DMA allocation) + kernel heap disclosure (~up to 196 KB past the record DMA buffer) → privesc-grade.

Root cause (path:line)

• envy24chan_trigger PCMTRIG_START else-branch, sys/dev/sound/pci/envy24.c:1810-1812: ch->offset = ((ptr / ch->blk + 1) * ch->blk % (ch->size / 4)) * 4 / ch->unit; executed when sc->run[slot] != 1 — i.e. for every channel after the first of the same direction. offset can be as large as dsize-1 (S32_LE: 8191/2 = 4095, dsize = 4096).
• envy24_p32sl envy24.c:1414-1415: src = readyptr/4; dst = src/2 + ch->offset; then envy24.c:1421-1422 writes dmabuf[dst * ENVY24_PLAY_CHNUM + slot{,+1}] before dst %= dsize (1424). First-iteration dst ≤ (dsize-1) + (ssize/2-1)... concretely for S32_LE: dst ≤ 4095+4095 = 8190 → index up to 8190*10+8 = 81908 vs 40960 entries in pbuf (ENVY24_PLAY_BUFUNIT * ENVY24_SAMPLE_NUM = 163840 bytes, allocated at envy24.c:2244-2255 via bus_dmamem_alloc).
• Same pattern: envy24_p16sl (1447-1457), envy24_p8u (1489-1496).
• Record mirror: envy24_r32sl (1519-1527) / envy24_r16sl (1549-1557) read dmabuf[src * ENVY24_REC_CHNUM + slot{,+1}] with src = dst/2 + ch->offset unclamped past ssize → reads up to ~2× past the 49152-entry rbuf into the user's record stream (kernel heap disclosure).

User reachability (unprivileged)

• /dev/dspN is created 0666 (sound.c:1134-1139, clone device). Each open gets its own hw channel of the 5 play / (2+adcn) rec channels registered at attach (envy24.c:2586-2597). Two play opens → two hw play channels → the second PCMTRIG_START runs the offset branch.
• src (readyptr) is exactly the number of PCM bytes the user wrote before triggering — attacker-chosen. ptr (the running first channel's hw position) is observable via SNDCTL_DSP_GETOPTR/GETOSPACE on the running channel, so the resulting write index is computable in advance; retriggering varies offset across [0, dsize-1].
• The write value is the user's PCM payload: full 32-bit control with S32_LE (p32sl stores data[src] verbatim), 24-bit (<<16) with S16_LE, 8-bit with U8. One OOB write pair per emldma pass, repeatable on every subsequent EMLDMAWR/START while readyptr/2 + offset >= dsize.

Reproduction

• Guest: DragonFly 6.5-DEVELOPMENT (env.txt) — pciconf shows 0 envy24 (ICE1712, vendor 0x1412) devices; the snd_envy24 driver cannot attach, so no live /dev/dsp trigger is possible on this guest.
• emldma_harness.c runs the verbatim driver functions (play+rec+the trigger offset formula) against a canary arena sized exactly like the kernel buffers. Results (run.log; identical across run.2/run.3): S16_LE +928 B past pbuf (value 0xa7a70000); S32_LE +81,968 B past (value 0xb9b9b9b9); U8 +5,048 B; record direction leaked 2/1 samples from past rbuf into the user buffer; hard-mode guard page (exact kernel size) faults at the first write. The arithmetic is deterministic — no race, no hardware state needed beyond a second running channel.

Exploit chain (real hardware)

open /dev/dsp0.p0 (play) + write + start → open /dev/dsp0.p1, SETFMT S32_LE, SETFRAGMENT/SETBLKSIZE, fill buffer, observe p0 hwptr via GETOPTR, start p1 → ch->offset computed → first emldma writes attacker 32-bit values at pbuf + (dst*10+slot)*4 with dst ∈ [4096, 8190] → up to ~82 KB past the 160 KB bus_dmamem_alloc region into adjacent kernel heap; repeat with varying offsets (each second-channel start of the 5 play channels, or re-open) → corrupt adjacent objects (on this family of allocations: other DMA buffers / driver softcs) → forge pointer-bearing object → uid=0. Record direction gives the complementary heap disclosure for defeating any layout uncertainty. On the standard no-SMAP/SMEP/KASLR target this is a credible unpriv→root chain; not demonstrated live for lack of the PCI device in QEMU.

Fix

fix.diff — wrap the phase-adjusted index before the first access in all five emldma functions: dst = (src / 2 + ch->offset) % dsize; (play) and src = (dst / 2 + ch->offset) % ssize; (rec). Fix-validated: emldma_harness_fixed.c (same verbatim code with the fix) reports 0 OOB writes, 0 leaked samples, and no guard-page fault (fix_run.log). The identical pattern exists in sys/dev/sound/pci/envy24ht.c:1324-1399 and should be fixed the same way.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.