DF-4539 — cs4281 attach ignores mixer_init()/pcm_addchan() failures; half-attached device NULL-derefs on suspend/resume

What this is

cs4281_pci_attach() ignores three return values and advertises success unconditionally:

• mixer_init(dev, ...) at cs4281.c:845 — return ignored. If it fails, snddev->mixer_dev stays NULL, yet attach succeeds.
• pcm_addchan(dev, PCMDIR_PLAY, ...) (cs4281.c:850) and pcm_addchan(dev, PCMDIR_REC, ...) (cs4281.c:851) — returns ignored. pcm_addchan fails (sound.c:1125-1141) when chn_init → cs4281chan_init fails, which happens when sndbuf_alloc() fails (cs4281.c:326-328). That early return leaves the embedded sc->pch/sc->rch with ch->parent == NULL, ch->channel == NULL (set only at cs4281.c:329-330/337, after the failure return).

The driver then calls pcm_setstatus and reports the device healthy.

Consequences (both root-gated: ACPI suspend/resume)

• cs4281_pci_resume() (cs4281.c:941-949) unconditionally invokes cs4281chan_setspeed(NULL, &sc->rch, ...) etc. → adcdac_go(ch, 0) (cs4281.c:474-479) → cs4281_rd(sc, ...) with sc = ch->parent == NULL → NULL-pointer dereference panic.
• cs4281_pci_resume → mixer_reinit(dev) (cs4281.c:935) → mixer.c:828-829: pdev = mixer_get_devt(dev) returns snddev->mixer_dev (NULL after the ignored mixer_init failure, mixer.c:118-124) and is derefenced pdev->si_drv1 without a check → NULL-pointer dereference panic.

No unprivileged trigger: suspend/resume requires root. Severity Low (robustness/DoS under resource pressure at attach + later suspend).

Build / run

./build.sh    # guest build of the environment probe
./run.sh      # documents: no CS4281 hardware on this guest

Fix

fix.diff adds defensive guards to cs4281_pci_resume (skip restore when either channel never initialized). The attach-side checks for mixer_init/pcm_addchan returns + bad_unregister: unwind are in the DF-4537 fix (same attach function); this diff is the resume-side backstop. git apply --check clean; never applied to sys/.

DF-4539 VERDICT — untested (hardware-gated), analysis certain

Source chain

1. mixer_init() return ignored: cs4281.c:845.
2. pcm_addchan() returns ignored: cs4281.c:850-851. pcm_addchan fails when chn_init fails (sound.c:1125-1141); cs4281chan_init fails when sndbuf_alloc fails (cs4281.c:326-328) and returns BEFORE ch->parent = sc; ch->channel = c; ch->dma_chan = ... (cs4281.c:329-337), so the embedded channel structs keep parent == NULL from the M_ZERO'd softc (cs4281.c:765).
3. Despite both failures the attach path continues to pcm_setstatus (cs4281.c:856) and returns 0.
4. On a later suspend/resume: * cs4281_pci_resume (cs4281.c:941-949) calls cs4281chan_setspeed(NULL, &sc->rch, sc->rch.spd) → adcdac_go(ch, 0) (cs4281.c:474-479) → cs4281_rd(sc, ...) (cs4281.c:146-150) with sc = ch->parent == NULL → NULL deref (reads sc->st at offset of bus_space tag) → panic. * mixer_reinit(dev) at cs4281.c:935 → mixer.c:828-829 pdev = mixer_get_devt(dev); m = pdev->si_drv1; where mixer_get_devt (mixer.c:118-124) returns snddev->mixer_dev == NULL when the ignored mixer_init failed → NULL deref panic.

Preconditions

• sndbuf_alloc failure (busdma/DMA memory pressure at attach) for the addchan leg, or any mixer_init failure for the mixer leg;
• then ACPI suspend+resume (root).

No unprivileged path exists; both legs need root to trigger. Low.

Why untested

The audit guest has no vendor-1013 CS4281 function (env.txt) — the attach, hence both failure legs, cannot occur; suspend of a nonexistent device is equally unreachable. Analysis is line-verified; classification untested, confidence certain.

Fix validation

fix.diff guards cs4281_pci_resume to fail cleanly when either channel never initialized (sc->rch.parent == NULL || sc->pch.parent == NULL → ENXIO before mixer_reinit/channel restore). The attach-side half (check mixer_init/pcm_addchan, unwind via pcm_unregister) ships in the DF-4537 fix; both apply clean (git apply --check). Not observable on this guest → fix_status not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.