DF-4116 — Guaranteed kernel panic in sndstat_sysuninit on sound.ko unload

File: sys/dev/sound/pcm/sndstat.c — pass 2 (GLM 5.3), LIVE-verified + fix-validated on the audit guest (DF 6.5-DEVELOPMENT X86_64_GENERIC, 2026-09-18). This is the root-cause resolution of the panic previously observed three times as a side note (DF-4026 panic.sndstat-unload.txt, DF-4115 pack §5, and the emu10kx run).

THE BUG sndstat.c tracks its single global sbuf with the invariant "sndstat_buflen == -1 <=> sbuf not allocated" (SNDSTAT_FLUSH, sndstat.c:74-79), but the static initializer sets sndstat_buflen = 0 (sndstat.c:68) — "allocated, empty" — while the sbuf is only actually created by sbuf_new() inside sndstat_open() (sndstat.c:146). If sound.ko is unloaded before any process has opened /dev/sndstat since load:

  * sound_modevent MOD_UNLOAD (sound.c:1433) calls
    sndstat_acquire(curthread) and never releases — deliberately
    handing sndstat ownership to the teardown — so si_drv1 holds the
    unloading process's pid;
  * the module SYSUNINIT (sndstat.c:466-476) runs sndstat_uninit(),
    whose PID guard (sndstat.c:444) therefore PASSES (P == P);
  * SNDSTAT_FLUSH() (sndstat.c:453) sees buflen == 0 != -1 and calls
    sbuf_delete() on the never-initialized, all-zero static sbuf;
  * subr_sbuf.c:100-101 KASSERT(s->s_buf != NULL) fires:

    panic: sbuf_delete called with uninitialized or corrupt sbuf

sys/config/X86_64_GENERIC:56 ships `options INVARIANTS`, so this
panics the STOCK kernel config, deterministically, on every
`kldload sound; kldunload sound` (or any snd_* driver unload that
cascades sound.ko via kern_linker.c:545) with no intervening
/dev/sndstat open.  Root-only trigger; impact = reliable kernel
panic (admin-action DoS), no memory corruption on non-INVARIANTS
kernels (sbuf_delete no-ops on the zeroed struct there).

BUILD: none (kernel module already present; trigger is kldload/kldunload) RUN (root): sh trigger.sh # stock: panics; patched: "UNLOADED-CLEAN rc=0" FIX: one line — static int sndstat_buflen = -1; (fix.diff), validated on a rebuilt sound.ko: panic gone, 3/3 clean cycles, busy-protection (unload while open => EBUSY) intact.

ARTIFACTS panic.txt / panic.2.txt two independent stock-kernel captures run.log full session log (A/B control + fix tests) build.log full patched-module build (-Werror clean) fix.diff the one-line fix (validated) verdict.json machine verdict (reproduced / panic / certain)

DF-4116 VERDICT — sndstat_sysuninit guaranteed panic on sound.ko unload

STATUS: reproduced (deterministic, 2 fresh captures this session + 3 prior independent observations); fix VALIDATED on rebuilt module. impact: panic (root-triggered admin-action DoS; stock X86_64_GENERIC carries INVARIANTS, so the KASSERT is live on the shipping config) confidence: certain

1. ROOT CAUSE (line-verified, every hop) sndstat.c:68 static int sndstat_buflen = 0; The SNDSTAT_FLUSH macro (sndstat.c:74-79) defines the invariant "buflen != -1 => sndstat_sbuf is allocated". The static initializer violates it: 0 means "allocated, empty" but the sbuf is only created by sbuf_new() in sndstat_open() (sndstat.c:146), which also sets buflen = 0 (sndstat.c:151) — the ONLY legitimate producer of the 0 state. sound.c:1433 sound_modevent MOD_UNLOAD: sndstat_acquire(curthread) and no matching release — by design: acquire parks the unloading thread's pid in si_drv1 so the teardown may proceed. This is why the PID guard in sndstat_uninit() (sndstat.c:444, SNDSTAT_PID(sndstat_dev) != curthread->td_proc->p_pid) PASSES on every successful sound.ko unload (same thread runs MOD_UNLOAD and the SYSUNINITs via sys_kldunload -> linker_file_unload). sndstat.c:453 SNDSTAT_FLUSH() with buflen == 0 -> sbuf_delete() on the all-zero static sndstat_sbuf. subr_sbuf.c:756+ sbuf_delete -> assert_sbuf_integrity -> subr_sbuf.c:100-101 KASSERT(s->s_buf != NULL, "sbuf_delete called with uninitialized or corrupt sbuf") -> panic. INVARIANTS is in the stock config: sys/config/X86_64_GENERIC:56.

2. WHY IT FIRES "EVERY TIME" YET WAS SEEN AS SPORADIC The panic requires buflen == 0 at unload, i.e. /dev/sndstat never opened-and-closed since sound.ko load. Sessions that cat /dev/sndstat (open+close sets buflen = -1 via SNDSTAT_FLUSH in sndstat_close, sndstat.c:171) unload cleanly. A/B on one boot (run.log RUN 2) isolates exactly this variable. Three earlier observations (emu10kx, DF-4026 channel.c session, DF-4115 snd_hda session) all had no sndstat reader between module load and unload.

3. REACHABILITY Root-only (kldload/kldunload). Variants that reach the same SYSUNINIT:

   • kldload sound; kldunload sound (minimal; RUN 1/2 here)
   • kldunload snd_<drv> cascading sound.ko through linker_file_unload's dependency recursion (kern_linker.c:545) — the DF-4115/DF-4026 shape (their traces show the recursive linker_file_unload frame). On a hypothetical non-INVARIANTS kernel sbuf_delete() would no-op on the zeroed struct (not dynamic => nothing freed; subr_sbuf.c:759-764) and unload would succeed — hence severity Medium, not High: shipping config panics, stripped-config survives.

4. EXPLOITABILITY No memory-safety primitive: sbuf_delete on the zeroed static struct only trips the assert; no attacker-controlled free, no UAF window found in the flush path. Ceiling = reliable kernel panic as root during a routine admin action (module rollback after driver test). Not an unprivileged trigger.

5. FIX (validated) fix.diff: initialize the sentinel to "not allocated": -static int sndstat_buflen = 0; +static int sndstat_buflen = -1; Rebuilt sound.ko on the guest (make -Werror clean, md5 9422fb6783b984413d3a47ef55d4fbc7):

   • exact trigger now returns UNLOADED-CLEAN rc=0 (was: panic)
   • 3/3 additional load/unload cycles clean
   • unload with /dev/sndstat held open still fails EBUSY (protection intact), clean unload after release FreeBSD resolved the whole class by rewriting sndstat to per-file cdevpriv sbufs (no global teardown at all); the one-liner is the minimal fix for DragonFly's current architecture.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.