DF-4361 — select_tuner() checks only the upper bound of tuner_type → negative index would walk tuners[] OOB (hardening; all current callers proven safe)

File: sys/dev/video/bktr/bktr_tuner.c (pass 2) Severity: Info (defense-in-depth) · Confidence: certain (defect certain, impact currently unreachable)

What

sys/dev/video/bktr/bktr_tuner.c:709  void select_tuner( bktr_ptr_t bktr, int tuner_type ) {
sys/dev/video/bktr/bktr_tuner.c:710      if (tuner_type < Bt848_MAX_TUNER) {     /* only UPPER bound */
sys/dev/video/bktr/bktr_tuner.c:711          bktr->card.tuner = &tuners[ tuner_type ];
sys/dev/video/bktr/bktr_tuner.c:712      } else {
sys/dev/video/bktr/bktr_tuner.c:713          bktr->card.tuner = NULL;
sys/dev/video/bktr/bktr_tuner.c:714      }

tuners[] is exactly 16 entries (bktr_tuner.c:119-280; NO_TUNER=0 … LG_TPI8PSB12P_PAL=15, Bt848_MAX_TUNER == 16, bktr_tuner.h:65). A negative tuner_type passes the check and stores &tuners[-1] (or further back). Consumers then dereference it: - tuner->pllControl[band] / tuner->bandAddrs[band] (bktr_tuner.c:825-826, 884-885) - bktr->card.tuner->name in the attach printout (bktr_card.c:1343-1344) → %s on a wild char * read from out-of-bounds rodata → potential kernel fault.

Caller enumeration (why Info, not higher)

Every reachable caller passes a provably non-negative value: 1. Boot tunable: masked bt848_tuner & 0xff (bktr_os.c:470, bktr_card.c:906) → 0..255; ≥16 → NULL. (Root-controlled anyway.) 2. BKTR_OVERRIDE_TUNER path — compile-time constant, not defined in the build. 3. Signature-table dispatch: single entry {5, 9, …} → tuner=9 (bktr_card.c:395-398, 862). 4. GPIO/EEPROM derivation: tuner_format <= 9 gating 10-entry constant tables (bktr_card.c:1128-1152), switch (((INL(...)>>10)-1)&7) (bktr_card.c:920-928) — all enum constants. So the OOB is currently unreachable; the defect is the missing lower-bound in a dispatch function that any future caller (or a future table entry typo'd negative) would turn into a wild read. Classic CWE-129 hardening.

Fix

--- a/sys/dev/video/bktr/bktr_tuner.c
+++ b/sys/dev/video/bktr/bktr_tuner.c
@@ -709,7 +709,7 @@ void    select_tuner( bktr_ptr_t bktr, int tuner_type ) {
-   if (tuner_type < Bt848_MAX_TUNER) {
+   if (tuner_type >= 0 && tuner_type < Bt848_MAX_TUNER) {
        bktr->card.tuner = &tuners[ tuner_type ];

Verification status

untested — requires Brooktree PCI hardware to reach any of this at runtime; the audit guest has no Brooktree/0x109e PCI device (pciconf -l clean), so /dev/bktr* never appears and select_tuner cannot execute there. Static caller enumeration above is exhaustive for this tree.

VERDICT — DF-4361

status: untested (hardening finding; hardware-gated path) · impact: none demonstrated — defect is real but currently unreachable with an out-of-range value · confidence: certain.

Reproduced?

No, by design of the finding: select_tuner() lacks the lower-bound half of its range check (bktr_tuner.c:710), so a negative tuner_type would store &tuners[negative] into bktr->card.tuner, which consumers dereference (tuner->pllControl[] / tuner->bandAddrs[] bktr_tuner.c:825-826, 884-885; card.tuner->name %s printout bktr_card.c:1343-1344). An exhaustive caller enumeration for this tree shows every reachable call site passes a provably non-negative value:

1. boot tunable path — masked bt848_tuner & 0xff (bktr_os.c:470, bktr_card.c:905-907);
2. compile-time BKTR_OVERRIDE_TUNER — not defined in any build file;
3. signature-table dispatch — single entry {card=5, tuner=9} (bktr_card.c:395-398, 862);
4. EEPROM/GPIO derivation — tuner_format <= 9 into 10-entry constant tables and &7-masked GPIO switch (bktr_card.c:920-928, 1128-1152).

Hence Info (defense-in-depth), not a higher severity: the memory-unsafe half of the index check is missing in a dispatch function where a future caller, table typo, or config change (BKTR_OVERRIDE_TUNER) immediately converts it into a wild kernel read.

Runtime exercise would additionally require Brooktree PCI hardware: the audit guest (DragonFly 6.5-DEVELOPMENT x86_64, QEMU/KVM) has no 0x109e PCI device (pciconf), so /dev/bktr* never appears and select_tuner cannot run there.

Fix validation

not_testable — path needs the PCI card; the fix is a one-sided bound addition (tuner_type >= 0 &&) with no behavior change for any currently-valid value.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)