DF-4538 — cs4281_pci_detach() releases the BA0/BA1 register mappings before tearing down the interrupt handler that reads them

What this is

cs4281_pci_detach() (cs4281.c:878-901) releases the BA0 register window (cs4281.c:893) and the BA1 memory window (cs4281.c:894) before bus_teardown_intr() (cs4281.c:895). The interrupt handler (cs4281_intr, registered at cs4281.c:812, shared-IRQ capable per cs4281.c:806 RF_SHAREABLE) reads CS4281PCI_HISR/HDSR through those mappings (cs4281_rd, cs4281.c:146-150) on every line assertion, and pcm_unregister() does not unregister the handler. During the window between the two releases and the teardown, an interrupt (its own or a shared line level) dispatches into bus_space reads of already-released rman resources — use-after-release of the register mapping, typically a kernel panic.

Sibling drivers get the order right (es137x.c:1917-1919 tears down the interrupt before releasing IRQ and registers); cs4281 (and its bad: unwind at cs4281.c:867-870, which has the same inverted order) does not.

Trigger: root unloading snd_cs4281 (kldunload) while the device raises or shares an interrupt. Unprivileged users cannot reach this; severity Low.

Build / run

./build.sh    # guest build of the environment probe
./run.sh      # documents: no CS4281 hardware on this guest (detach path unreachable)

Fix

fix.diff moves bus_teardown_intr() + IRQ release ahead of the BA0/BA1 register releases in cs4281_pci_detach(), matching es137x.c:1917-1919. git apply --check clean; never applied to sys/.

DF-4538 VERDICT — untested (hardware-gated), analysis certain

Source chain

1. snd_setup_intr(dev, sc->irq, 0, cs4281_intr, sc, &sc->ih) at cs4281.c:812 installs the ISR; the IRQ resource was allocated RF_SHAREABLE (cs4281.c:805-806).
2. cs4281_intr (cs4281.c:512-533) immediately reads cs4281_rd(sc, CS4281PCI_HISR) (cs4281.c:517) — i.e. a bus_space read through sc->st/sc->sh, the BA0 mapping — before deciding whether the interrupt is ours (there is no early filter/ITHREAD filter separation here).
3. cs4281_pci_detach (cs4281.c:878-901) first calls pcm_unregister (cs4281.c:884) — which stops channels/mixer but does not unregister the ISR — then releases the BA0 register resource (cs4281.c:893) and BA1 memory (cs4281.c:894), and only then runs bus_teardown_intr (cs4281.c:895).
4. In the window between (3)'s releases and the teardown, any interrupt on the (shared) line dispatches cs4281_intr into reads of released rman-backed mappings → use-after-release; typical outcome panic.
5. The bad: attach-unwind has the same inverted order (cs4281.c:867-870: bus_teardown_intr after the two bus_release_resource calls), though reaching it additionally requires an attach failure.
6. Correct ordering exists in the sibling es137x driver (es137x.c:1917-1919: teardown_intr, release IRQ, release regs).

Why untested

Requires a real CS4281 PCI function to exist (so attach succeeded and detach can run) plus root (kldunload snd_cs4281) plus an interrupt arrival inside the release window. The audit guest has no vendor-1013 function (env.txt, run.log) — the detach path cannot execute here at all. Static chain verified line-by-line; classification untested, confidence certain, no unprivileged impact (root-gated) → Low.

Fix validation

fix.diff reorders detach to teardown_intr → IRQ release → BA0/BA1 release. git apply --check clean. Not observable on this guest (no CS4281 hardware) → fix_status not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.