PoC DF-4526 — ar5416AniControl NULL-pointer deref before first channel set

What this is

ar5416AniControl() handles being called with no current channel ("This function may be called before there's a current channel (eg to disable ANI.)", ar5416_ani.c:180-185) only for HAL_ANI_PRESENT and HAL_ANI_MODE. For every other command it dereferences params/aniState:

struct ar5212AniState *aniState = ahp->ah_curani;   /* :177 */
const struct ar5212AniParams *params = AH_NULL;      /* :178 */
if (aniState != AH_NULL)
        params = aniState->params;                   /* :184-185 */
...
if (((1 << cmd) & AH5416(ah)->ah_ani_function) == 0) /* :217 gate */
        return AH_FALSE;
switch (cmd) {
case HAL_ANI_NOISE_IMMUNITY_LEVEL:
        u_int level = param;
        if (level > params->maxNoiseImmunityLevel) { /* :230 NULL READ */
...
case HAL_ANI_OFDM_WEAK_SIGNAL_DETECTION:
        ...
        aniState->ofdmWeakSigDetectOff = !on;        /* :296 NULL WRITE */

Attach-time state makes both reachable through the diagnostic api:

• the ar5416 softc is allocated zeroed (ar5416_attach.c:312 "NB: memory is returned zero'd") → ah_curani == NULL until the first ar5416AniReset() (only there is ah_curani published, ar5416_ani.c:561);
• ar5416Attach() enables every ANI command: AH5416(ah)->ah_ani_function = 0xffffffff (ar5416_attach.c:244) → the function gate at :217 passes;
• HAL_DIAG_ANI_CMD forwards user (cmd, param) verbatim to ah_aniControl() (ar5212_misc.c:1098-1103, reached from ar5416 via ar5416GetDiagState → ar5212GetDiagState, ar5416_misc.c:557), so ioctl(SIOCGATHDIAG, {HAL_DIAG_ANI_CMD, {1, 0}}) on an ath(4) device that has not yet tuned a channel executes the NULL deref → kernel page fault → panic. HAL_ANI_OFDM_WEAK_SIGNAL_DETECTION gives a NULL write at offset 3 instead.

Reachability gates: requires a kernel built with options ATH_DIAGAPI (not in stock X86_64_GENERIC — LINT64 only), ath(4) hardware present, and the SIOCGATHDIAG ioctl — which has no privilege check on DragonFly (if_ath_ioctl.c:299-300; contrast SIOCZATHSTATS at :288; already filed as DF-2059/DF-4320), making the panic reachable by any local user on such kernels.

Why a userspace harness (hardware gate)

The audit QEMU guest has no Atheros radio and QEMU cannot emulate one, so the in-kernel path cannot be executed here (same gate as DF-1676/ DF-2511 evidence packs). ani_null_deref.c is a compile-faithful replica of the dispatch flow with the attach-time state; --deref actually performs the NULL load and dies with SIGSEGV, demonstrating the fault is on the cited instruction.

Build / run (guest or any POSIX host)

cc -O2 -Wall -o ani_null_deref ani_null_deref.c
./ani_null_deref           # flow trace, flags the deref   -> BUGGY
./ani_null_deref --deref   # performs the NULL read        -> SIGSEGV
./ani_null_deref --fixed   # simulates the guard           -> PATCHED

Fix

fix.diff — NULL guard after the PRESENT/MODE handling, before the function gate.

VERDICT — DF-4526

Status: not_reproduced on the guest (hardware-gated: no ath(4) radio exists in QEMU). Impact if the gate is met: kernel NULL-deref panic (local DoS). The defect is code-certain; the userspace harness proves the faulting instruction executes under attach-time state.

The bug

ar5416AniControl() (sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c:172) guards only HAL_ANI_PRESENT (:190) and HAL_ANI_MODE (:193) against a missing current channel. All level/threshold commands dereference params (NULL whenever ah_curani == NULL, :178-185) or aniState itself:

• :230 params->maxNoiseImmunityLevel (HAL_ANI_NOISE_IMMUNITY_LEVEL)
• :317 params->maxFirstepLevel (HAL_ANI_FIRSTEP_LEVEL)
• :336 params->maxSpurImmunityLevel (HAL_ANI_SPUR_IMMUNITY_LEVEL)
• :296 aniState->ofdmWeakSigDetectOff = !on (NULL WRITE)
• :310 aniState->cckWeakSigThreshold = high (NULL WRITE)

Why it is reachable

1. ar5416 softc is zeroed at allocation (ar5416_attach.c:312) → ah_curani == NULL after attach; the pointer is only published in ar5416AniReset() (ar5416_ani.c:561), which runs on the first channel set.
2. ar5416Attach() sets ah_ani_function = 0xffffffff (ar5416_attach.c:244) → the command gate at ar5416_ani.c:217 passes for every command.
3. HAL_DIAG_ANI_CMD (ar5212_misc.c:1098-1103) passes user (cmd, param) straight to AH5212(ah)->ah_aniControl(); ar5416 routes its diag interface through the same handler (ar5416_misc.c:530,557). The SIOCGATHDIAG entry has no privilege check (if_ath_ioctl.c:299-300 — DF-2059/DF-4320), so on options ATH_DIAGAPI kernels any local user with a socket can trigger the panic between driver attach and first channel tune (e.g. immediately after boot, before ifconfig sets a channel).

Result in-kernel: read of *(int *)0x4-ish or write to *(uint8_t *)3 → page fault → Fatal trap 12 panic. Panic-only; no corruption primitive (fixed low address, fixed size).

Verification performed

• Full code-path trace (cited lines) from ioctl entry to faulting instruction — no intervening guard exists.
• ani_null_deref harness (this pack): replicates the dispatch with ah_curani=NULL, ah_ani_function=0xffffffff; --deref mode executes the NULL load and receives SIGSEGV on exactly the replicated instruction; --fixed shows the proposed guard returns AH_FALSE. Ran on the audit guest (BUILD_OK; outputs in run.log).
• Hardware gate: pciconf -l on the audit guest shows no Atheros PCI device; QEMU 7.2 has no ath HAL emulation; the ath driver cannot attach → in-kernel execution impossible in this environment.

Fix

One-line guard (fix.diff):

+   if (aniState == AH_NULL) {
+       HALDEBUG(ah, HAL_DEBUG_ANI, "%s: no current ani state\n", __func__);
+       return AH_FALSE;
+   }

placed after the HAL_ANI_PRESENT/HAL_ANI_MODE handling, before the function gate. (Upstream ar5212_ani.c has the same shape and would take the same guard.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.