DF-4543 — agp.c device-lifecycle: /dev/agpgart cdev outlives chipset detach; unit/minor mismatch in free path

What the finding is (pass 2, new — not any of DF-1685/1686/1687/1688/2397/2398/2399/2400)

sys/dev/agp/agp.c:

1. agp_generic_attach (agp.c:240-242) creates the userland device with a hardcoded minor 0 and name "agpgart", then stores the backing device_t in the cdev: sc->as_devnode->si_drv1 = dev;
2. agp_free_cdev (agp.c:248-251) removes it with dev_ops_remove_minor(&agp_ops, device_get_unit(dev)). That helper (sys/kern/kern_device.c → devfs_destroy_dev_by_ops(ops, minor)) matches cdevs by minor, not by unit. It is only correct for unit 0. For any agp device with unit != 0 the removal is a no-op — the agpgart node survives detach with si_drv1 pointing at the detached (and soon freed) device. A second simultaneous AGP bridge also collides on the same name/minor (two agpgart cdevs, each overwriting its own si_drv1).
3. Detach with the device open (any unit): destroy_dev only unlinks the node and drops the link refs (devfs_destroy_dev_worker, sys/vfs/devfs/devfs_core.c:1440-1463). An open file's vnode holds its own cdev reference, so the cdev — and si_drv1 — survives detach. After the driver finishes detaching, newbus frees the softc; the next ioctl(2)/mmap(2)/close(2) on the still-open fd runs agp_ioctl (agp.c:818-820) / agp_mmap (agp.c:857-858) / agp_close (agp.c:792-794) → kdev->si_drv1 → device_get_softc() → use-after-free read+write on the freed softc (ioctls write sc fields: as_state at agp.c:653-655, TAILQ ops at agp.c:481/496/800).

Trigger requirements (why this is Low)

• /dev/agpgart is UID_ROOT, GID_WHEEL, 0600 (agp.c:241) — root-only (no devfs rule widens it; checked etc/defaults/devfs.conf).
• Detach requires either a kernel built with agp as a loadable module (stock X86_64_GENERIC compiles it in — sys/config/X86_64_GENERIC:170 — so kldunload is impossible there) or ACPI/PCI hot-removal of the AGP bridge.

So: root-triggerable UAF, hardware/config-gated. Defense-in-depth value.

Reproduce

• ./run.sh — runs the liveness probe on the audit guest via dfbsd-qemu/vm.sh run_root.
• Expected on this guest: nothing happens — see VERDICT.md: the guest has no AGP hardware (QEMU bochs VGA, 7 PCI devices, no AGP caps, no /dev/agpgart), so the trigger surface does not exist to exercise. The probe output in run.log is the documented proof of hardware absence.

Fix

fix.diff — make agp_free_cdev refuse teardown while a client is open (returns EBUSY → detach fails, chip drivers propagate) and destroy the actual stored devnode instead of guessing minor == unit.

DF-4543 VERDICT — not_reproduced (attack surface absent on guest; code mechanics verified by trace)

Bottom line

The defect is real in the code (verified line-by-line below), but it is not reproducible on the audit guest: the guest has no AGP-capable hardware, so agp_generic_attach (sys/dev/agp/agp.c:240) never executes, /dev/agpgart does not exist, and no detach lifecycle can even begin. Beyond the hardware gate, the trigger is root-only (0600 root:wheel node) and requires either a module-built agp kernel (kldunload) or PCI/ACPI hot-removal — the stock X86_64_GENERIC kernel compiles agp in (sys/config/X86_64_GENERIC:170).

Liveness evidence (run.log, fresh run)

ls: /dev/agpgart: No such file or directory          (ls_rc=1)
kldstat | grep -i agp                                 (empty, rc=1)
vgapci0@pci0:0:2:0: class=0x030000 chip=0x11111234    (QEMU/bochs virtual VGA, vendor 0x1234)
pciconf -lc | grep -i agp                             (empty, rc=1 — no AGP capability on any device)
PCI device count: 7

No AGP bridge ⇒ no chipset driver probe/attach ⇒ no make_dev ⇒ no userland device ⇒ no lifecycle to race. Same probe rules out the AMD DCE audio path (no AMD display device: the only class-0x03 device is the bochs VGA).

Code trace (why the bug is real on suitable hardware)

1. agp_generic_attach — sys/dev/agp/agp.c:240-242: sc->as_devnode = make_dev(&agp_ops, 0, UID_ROOT, GID_WHEEL, 0600, "agpgart"); sc->as_devnode->si_drv1 = dev; Minor is hardcoded 0 and the name "agpgart" for every agp unit.

2. agp_free_cdev — sys/dev/agp/agp.c:248-251: dev_ops_remove_minor(&agp_ops, device_get_unit(dev)); dev_ops_remove_minor (sys/kern/kern_device.c) forwards to devfs_destroy_dev_by_ops(ops, minor) which matches cdevs by si_ops+minor. The created cdev has minor 0; the removal uses the unit. - unit 0: matches (correct removal), but only unlinks + release_dev (sys/vfs/devfs/devfs_core.c:1440-1463); an open fd's vnode keeps the cdev (and si_drv1) alive past softc free → UAF on that fd. - unit != 0: matches nothing → node never removed; after detach+softc free, the surviving /dev/agpgart has a dangling si_drv1 and any later open by root enters agp_open (agp.c:777-779) on freed memory.

3. Consumer derefs of the dangling pointer: agp_open agp.c:777-779, agp_close agp.c:792-794, agp_ioctl agp.c:818-820, agp_mmap agp.c:857-858 — all do device_get_softc(kdev->si_drv1).

4. No chip-driver detach checks for an open client: agp_via.c:226, agp_sis.c:172, agp_amd64.c:251, intel-gtt.c:914 all call agp_free_cdev(dev) blindly and proceed to free the GATT/resources.

Why not the known findings

DF-1685/2397 are races between ioctls on an attached device; DF-1686/2400 is the mmap off-by-one; DF-1687/2399 is the every-close wipe; DF-1688 the signed unbind loop; DF-2398 the bind bounds-check wrap. None of them covers attach/detach device lifecycle or the free_cdev unit-vs-minor mismatch.

Exploit chain

None developed — hardware gate. On suitable hardware the primitive would be: root opens /dev/agpgart, keeps fd; root unloads agp.ko (module kernel); ioctl on the fd hits freed softc → UAF write via as_state/TAILQ fields. Purely privileged; escalation value ~none (already root). It is a correctness/robustness UAF worth fixing.

Fix validation

fix.diff authored (agppriv.h + agp.c + 4 chip drivers): refuse agp_free_cdev while sc->as_isopen, propagate EBUSY from all detaches, and destroy_dev(sc->as_devnode) instead of the minor guess. Not testable on this guest: no AGP hardware to attach, and agp is compiled into the guest kernel so no module unload exists to drive the lifecycle.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.