DF-4468 VERDICT — snd_solo dangling /dev/mixerN after failed attach (8th family instance)

Status: INCONCLUSIVE (code-proven; not exercisable on this guest)

The audit guest has no ESS Solo-1 PCI function (QEMU emulates es1370, not ES1938/ES1946), and the failure precondition (pcm_register() failing after mixer_init() succeeded) requires either a feeder-subsystem veto flag or

PCMMAXUNIT sound units — neither injectable at runtime on stock hardware. Same verification posture as family instances DF-4421 (ich) and DF-4457 (cmi).

Root cause (path:line)

1. sys/dev/sound/pci/solo.c:1045 — mixer_init(dev, &solomixer_class, sc) is called BEFORE pcm_register (line 1052).
2. sys/dev/sound/pcm/mixer.c:730-733 — mixer_init() immediately does make_dev(&mixer_ops, ..., 0666, "mixer%d", unit) and stores pdev->si_drv1 = m; snddev->mixer_dev = pdev; where the kobj mixer m keeps m->devinfo = sc (mixer.c:616-649, mixer_obj_create).
3. sys/dev/sound/pci/solo.c:1052-1053 — if pcm_register(dev, sc, 1, 1) fails, goto no runs ess_release_resources(sc, dev).
4. sys/dev/sound/pci/solo.c:878 — kfree(sc, M_DEVBUF). No mixer_uninit() runs: the only caller of mixer_uninit is pcm_unregister (sound.c:1205), which newbus never invokes for a failed attach.
5. Result: /dev/mixerN remains a registered world-writable cdev whose kobj devinfo points into freed memory. First open()+ioctl() by any local user reaches essmix_init/essmix_set/essmix_setrecsrc (solo.c:651/668/728) → mix_getdevinfo(m) (mixer.c:616) returns the freed sc → ess_setmixer() (solo.c:241) reads sc->sb (a struct resource *) from freed heap and performs port I/O via rman_get_bustag(sc->sb). UAF-read → forged bus_space handle → out-of-bounds port I/O; realistic outcome is kernel fault / DoS, with heap-grooming dependent potential for worse.

Why pcm_register can fail (solo.c:1052)

• sound.c:1021-1025 — pcm_veto_load set (feeder subsystem error at boot, sound.c:50 / feeder.c:126).
• sound.c:1027-1033 — device unit > PCMMAXUNIT.

Both are operator/boot dependent; not attacker-triggerable on demand — hence Low severity, consistent with the 7 filed family instances.

Fix

Match the family fix: unwind the mixer before freeing resources —

--- a/sys/dev/sound/pci/solo.c
+++ b/sys/dev/sound/pci/solo.c
@@ -1049,6 +1049,8 @@ ess_attach(device_t dev)
            rman_get_start(sc->io), rman_get_start(sc->sb), rman_get_start(sc->vc),
        rman_get_start(sc->irq),PCM_KLDSTRING(snd_solo));

+   sc->mixer_ok = 1;   /* mark: mixer_init() succeeded */
+
        if (pcm_register(dev, sc, 1, 1))
        goto no;
@@ -1060,6 +1062,9 @@ ess_attach(device_t dev)

 no:
+   if (sc->mixer_ok)
+       mixer_uninit(dev);
        ess_release_resources(sc, dev);
        return ENXIO;
 }

(plus int mixer_ok; in struct ess_info). The systemic fix is moving the mixer_init() call after pcm_register()+pcm_addchan() success across the whole sound family, or making pcm_register failure paths call mixer_uninit.

Attempts

• Guest run of ./trigger /dev/mixer0 → ENOENT (no ESS hw): run.log.
• Code-level trace completed as above; no false-positive indicators.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.