DF-4457 — cmi_attach error path after mixer_init leaves a live 0666 /dev/mixerN pointing at freed sc (UAF on open/ioctl)

7th instance of the DF-4156/4193/4299/4334/4344/4421 sound-driver family, in sys/dev/sound/pci/cmi.c.

Reproduce (on hardware with a CMI8738-class card)

1. sh trigger.hw.sh — preconditions and expected dangling-cdev state.
2. Success criterion: after a failed snd_cmi attach that got past mixer_init(), ls -l /dev/mixerN still shows the 0666 cdev and any unprivileged open+ioctl(MIXER_WRITE(...)) dispatches through the freed softc (garbage bus_space reads/writes / panic under INVARIANTS).

On the audit QEMU guest

sh run.sh — proves the gate: no CMedia/audio PCI device, snd_cmi.ko cannot load (midi dependency mismatch). Runtime reproduction is impossible on this guest; the defect is proven by source trace (VERDICT.md).

Build (fix compile-validation)

sh build.sh (inside guest, with the fixed cmi.c staged at /root/cmi.fixed.c) — baseline and fix both build -Werror clean.

Files

• VERDICT.md — full narrative, root-cause table, negative results
• trigger.hw.sh — real-hardware trigger
• run.sh + run.log / guest_check.log — guest hardware-gate proof
• build.sh + build.log — pristine & patched module builds
• fix.diff — git-apply-able unified diff (validated: applies clean, compiles -Werror clean as a module on the guest)
• env.txt — guest environment

DF-4457 — PoC Verification Verdict

File: sys/dev/sound/pci/cmi.c (pass 2) Family: DF-4156 (maestro) / DF-4193 (es137x) / DF-4299 (emu10kx) / DF-4334 (via8233) / DF-4344 (atiixp) / DF-4421 (ich) — 7th instance. Guest: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR), cc 8.3.

Verdict: INCONCLUSIVE at runtime (code defect Certain; hardware-gated)

Root cause (source-trace proof)

cmi_attach() calls mixer_init(dev, &cmi_mixer_class, sc) at cmi.c:986 and pcm_register(dev, sc, 1, 1) at cmi.c:989. mixer_init() (mixer.c:687-764) creates a world-writable cdev:

mixer.c:730  pdev = make_dev(&mixer_ops, PCMMKMINOR(unit,0,0),
mixer.c:731              UID_ROOT, GID_WHEEL, 0666, "mixer%d", unit);
mixer.c:732  pdev->si_drv1 = m;         /* m->devinfo = sc (mixer.c:78) */

If pcm_register() fails it returns non-zero (EINVAL via pcm_veto_load, sound.c:1021; ENODEV via unit > PCMMAXUNIT=255, sound.c:1027) and cmi_attach goto's bad: (cmi.c:1004-1016), which destroys the dma tag, tears down the irq, releases reg/irq resources, snd_mtxfree(sc->lock) and kfree(sc, M_DEVBUF) — without mixer_uninit(dev). The 0666 /dev/mixerN cdev stays registered with si_drv1 -> m -> devinfo == freed sc:

• any later open("/dev/mixerN") / ioctl(MIXER_*) dispatches cmimix_set/cmimix_init/cmimix_setrecsrc (cmi.c:654-750) → mix_getdevinfo(m) == freed sc → cmi_rd/cmi_wr(sc, ...) reads and writes through the freed ~264-byte M_DEVBUF chunk (sc->st, sc->sh, i.e. type-confused bus_space tag/handle read from freed heap).
• the mixer keeps its OWN m->lock (mixer.c:71-72), so the UAF is not masked by the freed sc->lock.

Why not runtime-reproduced on this guest

1. No hardware: QEMU presents no CMedia 13f6 device and no audio class 0x040x function at all (guest_check.log / run.log: pciconf -l shows only 1237/7000/7010/7113/1111:1234/virtio). cmi_probe() never matches → cmi_attach() never executes.
2. Module gate: kldload snd_cmi on this guest fails with KLD snd_cmi.ko: depends on midi - not available or version mismatch (serial console) — deployment itself is broken on the snapshot, so even a hypothetical device could not reach the driver.
3. Trigger gate (real hardware): the sole post-mixer_init failure path is pcm_register(), which only fails via pcm_veto_load (0 after sound(4) feeder init, feeder.c:126 — unreachable during PCI attach) or >255 sound units. Identical trigger shape to DF-4193/4334/4344/4421.

Ceiling on real hardware: local unprivileged UAF read/write through a 0666 cdev gated by an attach-time failure — Low, matching family precedent.

Negative results (classes hunted and killed in cmi.c, pass 2)

• cmi_intr() NULL-channel (cmi.c:562-568): sc->pch.channel is set during pcm_addchan→pcm_chn_create→chn_init→cmichan_init (sound.c:695-…, cmi.c:345-374) i.e. still within attach at cmi.c:994-995; before that, CH0/CH1 INTR_STATUS bits require DMA enabled which cmi_init (cmi.c:874-878) disables. Family-wide unguarded chn_intr(sc->pch.channel) (es137x.c:750, via8233.c:833, atiixp.c:712) — no cmi differential. Killed.
• pcm_addchan return ignored (cmi.c:994-995): robustness only — channel-less device, no chn_intr(NULL) reachable (DMA never enabled).
• cmichan_getptr modulo (cmi.c:529-531): sndbuf_resize floor is blkcnt>=2 × blksz>=16 (buffer.c sndbuf_resize EINVAL guard) so sndbuf_getsize() >= 32 — no div-by-zero; physptr arithmetic wraps within u32 and stays bounded by % sz.
• cmi_dma_prog u16 sample counts (cmi.c:261-267): sz ≤ 65536 (pcm_getbuffersize max 65536, cmi.c:969; dma tag maxsize sc->bufsz, cmi.c:971-977), bps ∈ {1,2,4} → s,i ≤ 65535, no truncation; i>=0 because sz ≥ 2*bps.
• cmimix_set cmt[dev] OOB (cmi.c:684): dev bounded by SOUND_MIXER_NRDEVICES in mixer.c before MIXER_SET dispatch (mixer_set validates mix->devs & (1<<dev)), and cmi's own mix_setdevs only enables cmt[i].bits != 0 entries.
• cmpci_rate_to_regvalue (cmi.c:222-247): i ≤ 7, cmi_rates[7] valid.
• cmi_resume lock recursion (cmi.c:1067-1092): snd_mtxcreate uses LK_CANRECURSE (sound.c) — safe.
• cmi_detach (cmi.c:1021-1047): pcm_unregister first (drains channels+cdevs), then teardown; sc->mpu_reg NULL-guarded; mpu401 paths dead (if (0) at cmi.c:957-958) — cmi_mread/cmi_mwrite hardcoded port 0x330 with NULL bus_space tags would be broken if ever enabled, but unreachable (note only).
• DMA tag: nsegments=1, maxsize=sc->bufsz ≤ 64K consistent with CMPCI DMA limits (cmi.c:969-977). No seg-count mismatch.
• SPDIF: no ioctl surface in cmi.c — sysctl spdif_enabled only (cmi_initsys, cmi.c:754-769); cmi_spdif_speed register-only.

Fix validation

fix.diff reorders pcm_register() ahead of mixer_init() and adds pcm_unregister(dev) on the mixer_init-failure path (pcm_unregister itself calls mixer_uninit, sound.c:1197ff, and handles zero channels — CHN_FOREACH over empty list). Validated to COMPILE cleanly with -Werror on the guest toolchain:

• baseline snd_cmi.ko: RC=0 (build.log)
• patched snd_cmi.ko (fix applied): RC=0, -Werror clean (build.log, guest_fixbuild output preserved in build.log)

Behavioral baseline/patched runs impossible on this guest (no CMI hardware — see above), hence fix_status=not_testable, compile-validated. git apply --check passes against the pristine read-only tree. Guest /usr/src restored to pristine after the build (md5 3a977e0dea384942133aa5707146f390 matches tree).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.