DF-4421 — snd_ich attach-failure path leaves live 0666 /dev/mixerN over freed AC97 codec + softc (UAF on open/ioctl)

6th instance of the pcm attach-error family (DF-4156 maestro, DF-4193 es137x, DF-4299 emu10kx-pcm, DF-4334 via8233, DF-4344 atiixp), this time in sys/dev/sound/pci/ich.c.

TL;DR

ich_pci_attach() calls mixer_init() (ich.c:1031) — which publishes a 0666 /dev/mixerN whose si_drv1 chain reaches the AC97 codec — before five more failure paths that all jump to bad: (ich.c:1045, 1053, 1060, 1065, 1069). bad: frees the codec (ac97_destroy, ich.c:1096-1097) and the softc (kfree, ich.c:1118) but never tears the mixer cdev down. Any later open/ioctl on /dev/mixerN dispatches through the freed codec's kobj'd methods table → use-after-free (read/write primitives through mixer_ioctl → mix_getdevinfo → freed struct ac97_info).

Not runtime-reproducible on the audit guest: QEMU (i440FX machine) presents no Intel ICH AC'97 controller (no class=0x0401 device; only 8086 chips 1237/7000/7010/7113 — see guest_check.log). snd_ich.ko loads but ich_pci_probe() never matches, so ich_pci_attach() never executes. Source-certain by construction and by symmetry with the 4 runtime-verified family members.

How to reproduce (on hardware with an ICH AC'97 controller)

Preconditions: any machine with an Intel ICH/ICH2/.../ICH7, SiS 7012, nForce, AMD-768/8111 AC'97 controller (PCI class 0401, e.g. 8086:2415), plus one of:

• memory pressure sufficient to fail bus_dmamem_alloc/bus_dmamap_load (ich.c:1060/1065), or
• bus_dma_tag_create failure (ich.c:1045/1053), or
• 33+ sound devices so pcm_register hits PCMMAXUNIT → ENODEV (sound.c:1027-1033), or
• a boot where feeder init left pcm_veto_load=1 → pcm_register returns EINVAL (sound.c:1021-1024).

# with hw.snd.maxunit exhausted (33rd sound card) or any alloc failure:
kldload snd_ich            # attach fails AFTER mixer_init succeeded
ls -l /dev/mixer0          # device still exists, 0666 root:wheel
dd if=/dev/mixer0 bs=64 count=1 | hexdump -C   # UAF read path
# or any SNDCTL_MIXER_* ioctl via /dev/mixer0  → UAF through freed codec

On the audit guest this is impossible — no AC'97 PCI function exists, so the trigger never reaches ich_pci_attach() (guest_check.log).

Artifacts

• VERDICT.md full narrative + root-cause table + negative results
• guest_check.log proof of hardware gate (no 0401 PCI device, no pcm dev)
• run.sh exact guest check commands (what was run)
• trigger.hw.sh the real-hardware trigger script
• fix.diff family-consistent fix (pcm_register before mixer_init)
• env.txt guest environment
• manifest.json machine-readable catalog
• verdict.json machine verdict (consumed by audit/persist_poc.py)

Fix

Reorder pcm_register() ahead of mixer_init() (no failure path may remain after the mixer cdev is published) and check mixer_init()'s return — the same shape accepted for DF-4334 (via8233). See fix.diff.

DF-4421 VERDICT — snd_ich /dev/mixerN UAF on attach-failure path

Status: inconclusive (code defect certain; kernel runtime hardware-gated) Impact ceiling: use-after-free reachable by any local user via a 0666 cdev (open/ioctl), with kernel read/write through the freed struct ac97_info methods table. Trigger requires the driver's attach to fail after mixer_init() — hardware/alloc-pressure dependent, hence Low severity, matching the family precedent.

Root cause (path:line)

Note ich.c is worse than atiixp (DF-4344, which had exactly one post-mixer failure point): five distinct gotos exist after mixer_init(), and ich.c additionally ignores mixer_init()'s return value entirely (ich.c:1031) — a failure there is silent (that direction is safe only because mixer_init cannot fail after make_dev; verified mixer.c:726-764).

Why not reproduced (hardware gate)

The audit guest is QEMU i440FX (guest_check.log): PCI inventory contains only 8086:1237/7000/7010/7113 — no class=0x0401 AC'97 audio function. ich_pci_probe() (ich.c:861-879) matches none of the ich_devs[] IDs against any device, so ich_pci_attach() never executes. snd_ich.ko itself loads cleanly (kldstat shows it; module compiled from the same source), proving the code is deployed in the module set — only the trigger hardware is absent. Same situation as verified family members DF-4334/DF-4344 on this guest.

Exploitability discussion (on real hardware)

• The dangling object is reachable through a 0666 cdev: any local UID (no group membership) can open it.
• Primitive: UAF read/write of moderate quality — mixer ioctls write attacker-scaled values into codec registers (ac97_wrcd → bus_space_write_2 through freed-but-stale pointers), read back codec state. The kobj methods table itself is freed (kobj_delete), so the dispatch already dereferences freed memory on the first ioctl.
• Grooming: struct ac97_info is M_AC97 (kmalloc ~ small size class); between attach failure and the mixer open there is no window pressure — an attacker who can cause the alloc failure (memory pressure is the realistic remote-ish knob) then sprays the size class.
• Realistic ceiling: local privesc UAF, but the trigger needs an attach-time failure — not attacker-schedulable at will. Family rated Low; consistent here.

Negative results (pass-2 classes hunted and killed — ich.c)

• ichchan_init writes sc->ch[num] fields BEFORE the default: return (NULL) bounds check (ich.c:375-384 vs 410-411) — would be an OOB write into trailing sc_info fields (ac97rate/dtbl/ich_lock) for num>=3. Killed: channel_init is invoked exactly once per pcm_addchan (sound.c:585 via pcm_chn_create), and ich.c calls pcm_addchan at most 3× (ich.c:1072-1075), so num ∈ {0,1,2} always. Unreachable.
• ichchan_setspeed (speed * 48000) (ich.c:467): no uint32 overflow — pcm core clamps via RANGE(hwspeed, caps->minspeed, caps->maxspeed) (channel.c:1983) with ich caps 8000..48000 → max 2.304e9 < 2^32. ac97rate guarded to (32000,64000) at ich.c:463-464.
• ichchan_getptr pos = civ*blksz (ich.c:557-560): in-bounds — ich_filldtbl clamps blksz*blkcnt <= sndbuf maxsize (ich.c:305-306) before the dtbl build; blkcnt ∈ [2,32] always (clamped ich.c:969-972, default 2), so no div-by-zero either. Post-calibrate blksz/blkcnt mismatch (ich.c:733-737 vs 776) self-heals: any later ichchan_setblocksize → ich_filldtbl re-clamps (ich.c:493-500), and even a hypothetical OOB hwptr is neutralized by the modulo in chn_dmaupdate (channel.c:387).
• ich_setmap (ich.c:818-824): reads only segs[0]; the BDL dma tag is created with nsegments=1 (ich.c:1045-1047), so the callback can never see more than one segment. No ICH_BD_CAPS-style seg-count issue.
• BDLE length field (ich.c:316-317): blksz ≤ maxsize/blkcnt ≤ 32768 (blkcnt ≥ 2), SIS7012 sample_size=1 (ich.c:903) → ≤ 32768 fits the 16-bit length field below IOC bit 31.
• ich_rdcd/ich_wrcd reg mask & 0xff (ich.c:269, 280): stays inside the 256-byte NAMBAR/MMBAR mapping; ich_waitcd bounded 1000×DELAY(1) (ich.c:252-257). Ignoring ich_waitcd's ETIMEDOUT (ich.c:270, 281) reads stale codec data on timeout — functional, not memory-unsafe (upstream-identical).
• ich_intr LVI arithmetic (ich.c:637-649): all quantities reduced modulo blkcnt/ICH_DTBL_LENGTH before the 8-bit register write; CIV read masked % blkcnt (ich.c:557); uninit ch[2].imask==0 (M_ZERO softc) skips cleanly when !hasmic.
• ich_pci_resume ich_init(sc) == -1 (ich.c:1198) is a dead check (ich_init returns 0/ENXIO, never -1): failed re-init not caught, but later mixer_reinit failure still returns ENXIO; no memory-safety consequence (upstream-identical cosmetic bug).
• 1 << (i - 1) at ich.c:966-968: UB when blocksize hint > bufsz makes blkcnt 0 — but hint is root-only (resource_int_value from device.hints), and on x86-64 the shift count masks to 31 → 0x80000000 → clamped to ICH_MAX_BLKCNT=32 (ich.c:971-972). Self-healing; not attacker-reachable. (Hardening note only.)
• Detach-vs-calibrate intrhook race (ich.c:1083-1090 hook established only during cold boot; ich_pci_detach ich.c:1122-1144 never disestablishes): the hook drains within seconds of boot before userland can kldunload — unreachable window.
• Suspend/resume trigger loop over ch[0..2] with uninitialized ch[2] (ich.c:1176-1183, 1212-1219): run_save/run are 0 via M_ZERO; loop bodies gated on them. Safe.

Fix validation

fix.diff applies the DF-4334 family shape to ich.c: * move pcm_register() to before mixer_init() (all DMA/dtbl setup stays before pcm_register, which needs sc->hasmic from the extcaps block — order: codec → extcaps → dtbl/dma → pcm_register → mixer_init (checked) → pcm_addchan), * check mixer_init()'s return (its failure leaves no cdev — verified mixer.c:726-764 has no failure path after make_dev).

git apply --check passes against the read-only sys/ tree. Additionally the patched driver was COMPILE-validated on the guest: the patched ich.c was pushed into the guest's /usr/src and make in /usr/src/sys/dev/sound/driver/ich compiled it with -Werror (cc 8.3) and linked snd_ich.ko (25784 bytes) — full untrimmed output in build.log (BUILD_RC=0). Guest source restored to pristine afterward (md5 2a290625f264317f5ce793fbb381a197 matches the audit tree). A behavioral patched-kernel run remains impossible on this guest: ich_pci_attach requires an ICH/SIS/nForce/AMD AC'97 controller the guest cannot present, so baseline/patched behavior is not demonstrable here (fix_status: not_testable, compile-validated). The semantics of the reorder were verified against sound.c:1016-1040 (pcm_register has no mixer dependency) and mixer.c (mixer_init has no channel dependency, and cannot fail after make_dev).

Guest state

snd_ich.ko was left loaded during the check (harmless: probes nothing, attaches nothing). Not unloaded because kldunload of snd_* on this guest panics in sndstat teardown — known DF-4116 (recorded in DF-4344's run); no reset needed since no panic occurred and no persistent state changed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.