DF-4480
ac97mix_setrecsrc() reads codec->mix[AC97_MIXER_SIZE] out of bounds when src==0 (latent OOB read; guard present upstream)
Summary
If no bit of src is set the loop exits with i==25 and setrecsrc indexes one struct past mix[], landing on codec->name[] - garbage recidx selects a bogus RECSEL value and the function returns a nonexistent 1<<25 bit. Latent today (mixer core always substitutes a valid source; recdevs never zero), live if any future patch/quirk zeroes the recidx entries - same pattern as the reachable DF-1321/1330. One-line FreeBSD guard fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4480 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 905 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
fix in finding markdown
per-fix-DF-4480
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Same pattern as DF-1321/1330 where it WAS reachable. One-line guard (FreeBSD carries it). Fix in finding markdown.
Verdict
not_run: latent - mixer core always substitutes a valid source when recdevs!=0 (always true today); guest codec unaffected
No comments yet.