DF-4138 — ppc_pc873xx_detect() static probe index is never reset:

OOB read past pc873xx_basetab[] used as an I/O port number

Root cause

sys/dev/misc/ppc/ppc.c:432-439:

static int
ppc_pc873xx_detect(struct ppc_data *ppc, int chipset_mode)
{
    static int  index = 0;          /* <-- static, never reset */
    ...
    while ((idport = pc873xx_basetab[index++])) {
    (void)inb(idport); ...
    outb(idport, PC873_SID);
    val = inb(idport + 1);

pc873xx_basetab[] (ppc.c:415) has 5 entries (4 ports + 0 sentinel). index is a function-static that is never re-initialized; every call to ppc_pc873xx_detect resumes where the previous one stopped.

• 1st call (1st parallel port): walks the table from 0.
• 2nd call (2nd port, or a re-probe): pc873xx_basetab[5], [6], ... — out-of-bounds reads of kernel .data past the table. The values read there (e.g. pc873xx_porttab[] = 0x378/0x3bc/0x278, then pc873xx_irqtab[], then the pc873xx_regstab[] contents and finally the pointer values of pc873xx_rnametab[]) are used as idport: inb(idport) / outb(idport, PC873_SID) / inb(idport + 1) are executed on arbitrary port numbers — including writes to semi-arbitrary x86 I/O ports (keyboard 0x60/0x64, POST/reset 0xCF9, CMOS 0x70/0x71 are all in reach depending on adjacent .data), and the loop keeps advancing on every call, reading further and further past the array.

Reachability

Gated on options PPC_PROBE_CHIPSET (ppc.c:406/1274/1295): not in GENERIC (X86_64_GENERIC does not compile ppc at all); enabled only in LINT64 or custom kernels, and needs >= 2 ppc attach attempts through the chipset detect loop (2+ ISA parallel ports, or repeated probes). The ppc driver itself is not in the shipped GENERIC kernel and the paravirtual guest has no ISA parallel port, so this is source-level certainty only.

Fix

--- a/sys/dev/misc/ppc/ppc.c
+++ b/sys/dev/misc/ppc/ppc.c
@@ -433,7 +433,7 @@
 static int
 ppc_pc873xx_detect(struct ppc_data *ppc, int chipset_mode)
 {
-    static int index = 0;
+    int        index = 0;
     int        idport, irq;
     int        ptr, pcr, val, i;

(the variable was pointlessly static; it must start at 0 per probe).

Verification

Skipped live (hardware-gated: guest has no parallel port; driver not in GENERIC; option not enabled). Analysis-certain: the missing reset is unambiguous from source.