DF-4465
uguru_attach ENXIO paths leak the active IOPORT resource and permanently wedge the driver until reboot
Summary
attach allocates the 0xe0..0xe7 RF_ACTIVE port range then returns ENXIO at three later points without bus_release_resource; newbus does not release child resources on failed attach, so the range stays owned by the dead device and every later probe fails - monitoring dead until reboot. The stateful handshake makes a mid-attach glitch a realistic field condition; a spoofed ISA device deterministically bricks the driver. Release-on-err fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4465 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 918 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware-gated / Info
fix in finding markdown
per-fix-DF-4465
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Three ENXIO returns after successful bus_alloc_resource never release it; newbus does not release child resources on failed attach. release-on-err fix.
Verdict
not_run: no uGuru hardware on guest; realistic field condition via stateful handshake glitch
No comments yet.