DF-4349

adv_run_doneq completes ccb_infos entries without ACCB_ACTIVE validation: in-bounds stale-slot double completion (double xpt_done/LIST_REMOVE/recycled-dmamap unload) and never-allocated-slot write through uninitialized cinfo->ccb

Summary

The firmware completion walk maps the raw 32-bit LRAM ccb_index to a kernel object with no allocation or state check. Facet A: an index naming an already-completed (FREE) ccb_info double-completes a stale CCB (LIST_REMOVE of a detached entry, stale callout_stop, recycled-dmamap unload, second xpt_done). Facet B: ccb_infos is kmalloc'd WITHOUT M_ZERO and slots are initialized lazily, so an in-bounds-but-never-allocated index writes through garbage (the :1262 comment shows the hazard was known). DF-2413 covers only the array-bounds half. Guest model: double-completion + wild write proven; fix predicate drops both. Validate+M_ZERO fix.

Discussion (0)

No comments yet.

Severity: Medium
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416
File: sys/dev/disk/advansys/advansys.c
Lines: 1106-1296
Area: dev
Discovered: 2026-09-19
Updated: 2026-09-19

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: panic
Confidence: certain
Tested: 2026-10-15 15:30:03
Attempts: 6
Runtime: 4800s
Code hash: 9c695ff5010595bb
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (6 cpus, 4GB)
Build cmd: vm.sh run_root 'sh /root/df43xx/build.sh' (make -m /usr/src/share/mk; KLD df43xx_rig.ko)
Run cmd: vm.sh run_root 'sh /root/df43xx/prime.sh && sysctl -w kern.df43xx.go=2' (0=selftest 1=control 2=facetA 3=facetB 5=forensic)

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-10-15 15:30:04
Runtime: —
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #2: Thu Oct 15 14:56:52 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC (both fixes) / #3 15:11 (4349-only)
fix.diff: findings/poc/DF-4349/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4349 · 17 files

File	Type	Size
df43xx_rig.c	—	41.5 KB	view raw
advlib.h	—	25.4 KB	view raw
Makefile	—	117 B	↓ download
build.sh	—	96 B	view raw
prime.sh	—	1.1 KB	view raw
run.sh	—	177 B	view raw
build_fixed.sh	—	1.1 KB	view raw
run.baseline.log	—	17.6 KB	view raw
panic.facetA.txt	—	937 B	view raw
panic.facetB.txt	—	1.3 KB	view raw
run.forensic.log	—	3.2 KB	view raw
run.bothfixed.log	—	34.3 KB	view raw
fix_run.log	—	20.1 KB	view raw
fix_build.log	—	1.3 KB	view raw
fix.diff	—	1.3 KB	view raw
env.txt	—	1.1 KB	view raw
verdict.json	—	6.5 KB	view raw

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff (predicate + M_ZERO) applied in guest /usr/src with DF-4350's budget fix, nativekernel+installkernel, reboot. Baseline kernel: go=2 panic (double adv_done), go=3 trap 12 at 0x41df41df42f3. Patched kernel: go=2 -> 'adv9: done queue ccb_index 0 not active, dropping completion' (guest alive), go=3 dropped, go=1 control completion still correct, go=4 cycle bounded (276-entry budget). Identical PoC bytes both runs.

run.bothfixed.log: patched-kernel boot (#2), scenario matrix RC=0 with 'dropping completion' messages and 'done queue walk exceeded 276 entries, stopping' then 'adv_intr RETURNED after 4273 data-port services'; panic.facetA.txt / panic.facetB.txt for the baseline reproductions

↓ fix.diffDragonFly dfbsd 6.5-DEVELOPMENT #2: Thu Oct 15 14:56:52 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC (both fixes) / #3 15:11 (4349-only)

Confirmed kernel references

Detail

Exploit chain

Crafted device done-queue entry (duplicated ccb_index, or in-bounds index >= ccb_infos_allocated) -> production adv_run_doneq maps it to a kernel object with no allocation/state check (advansys.c:1106-1109) -> facet A: second adv_done on a stale ccb = stale LIST_REMOVE (kernel list corruption; deterministic panic on INVARIANTS kernels), callout_stop/dmamap_unload on recycled live resources, second xpt_done (CAM UAF family); facet B: write through uninitialized cinfo->ccb (kernel-memory write at a heap-groomed address, demonstrated fault at 0x41df41df42f3). Impact ceiling on this rig: kernel panic from device-fed input; escalation to controlled kernel write requires physical AdvanSys HBA + firmware/hostile-peripheral control of the done-queue bytes.

Evidence (decisive lines)

panic.facetA.txt (double adv_done backtrace), panic.facetB.txt (trap 12 at 0x41df41df42f3, supervisor write, stopped at adv_intr+0x101 movl %edi,0x114(%rsi)), run.baseline.log (self-test PASS + control completion + facetA panic), run.forensic.log (recycled-slot silent enumeration + stale-variant guard panic), run.bothfixed.log (patched kernel: drops, no panic, budget-bounded cycle), build_fixed.sh + fix.diff

PoC changes

Replaced the seed userspace model with a production-handler KLD dispatch rig: fabricated post-attach softc with real bus_dma tag/dmamaps, production-exact ccb_infos kmalloc (M_DEVBUF, no M_ZERO) with deterministic heap grooming, ASC chip emulation (flat register page + LRAM latch/auto-increment protocol via x86 #DB watchpoints with a temporary IDT[1] gate), nm-resolved dispatch of the kernel's own adv_intr/adv_done/adv_copy_lram_doneq, sysctl-driven scenarios with control/selftest/forensic isolation, and real rebuilt-kernel fix validation.

Verified recommended fix

In adv_run_doneq reject ccb_index >= adv->ccb_infos_allocated or !(state & ACCB_ACTIVE) before completing (re-advance the walk and continue); kmalloc ccb_infos with M_ZERO as defense in depth.

Verdict

REPRODUCED against the shipped kernel binary via production-handler KLD dispatch: advansys.c is compiled into /boot/kernel/kernel, so the rig dispatches the real adv_intr()/adv_done() (nm-resolved, no KASLR) over a fabricated post-attach softc (real busdma, production non-zeroed ccb_infos kmalloc) with the ASC LRAM emulated byte-exactly (x86 watchpoint #DB service; self-test proves the production accessors round-trip every crafted field). Facet A: a duplicated done-queue entry naming an already-completed slot drives a second production adv_done - panic 'Bad link elm prev->next != elm' with a double adv_done frame under adv_intr (the stale LIST_REMOVE at advansys.c:1127; the INVARIANTS queue guard converts the filed silent list corruption into a deterministic kernel crash on this debug kernel, and the recycled-slot variant still corrupts silently: live callout stopped, live dmamap unloaded, slot double-returned, early completion -> double-xpt_done family). Facet B: a done entry naming an in-bounds never-allocated slot writes through groomed heap garbage - Fatal trap 12, fault address exactly 0x41df41df42f3, supervisor WRITE, stopped at adv_intr+0x101: movl %edi,0x114(%rsi), which is the ccb->csio.resid store of advansys.c:1108. Control run completes a legit entry cleanly, so only the crafted device bytes differ. Fix validated on a really rebuilt kernel (fix.diff applied in guest /usr/src, nativekernel+installkernel): both facets dropped, no panic, control still works, guest alive. Device-fed trigger (buggy/hostile firmware or corrupt LRAM) - no unprivileged-user or remote path; Medium severity confirmed.