DF-4546 — lm78 lm_detach on a zero-sensor attach (W83791SD) → NULL-pointer write + global sensordev_list corruption

Severity: Low (privileged detach trigger, obscure chip) | Confidence: certain File: sys/dev/powermng/lm/lm78.c:590-592,427-429,445-458

What

wb_match() claims the Winbond W83791SD without setting up any sensor table (lm78.c:590-592 — the only match case with no lm_setup_sensors). sc->numsensors stays 0, so lm_attach() bails at its guard (lm78.c:427-429) and sensordev_install() never runs. lm_detach() (lm78.c:445-458) then unconditionally calls sensordev_deinstall(&sc->sensordev).

sensordev_deinstall (kern_sensors.c:153-176) executes TAILQ_REMOVE(&sensordev_list, sensdev, list) on a node that was never inserted. The newbus softc is zeroed, so per the DragonFly TAILQ_REMOVE (sys/sys/queue.h:646-662):

if ((TAILQ_NEXT(elm, field)) != NULL) ...       /* tqe_next == NULL -> skip */
else (head)->tqh_last = (elm)->field.tqe_prev;  /* global list tqh_last = NULL */
*(elm)->field.tqe_prev = TAILQ_NEXT(elm, field);/* *(NULL) = NULL  <-- WRITE to 0x0 */

i.e. an immediate write through a NULL pointer (kernel panic) that first also clobbers the global sensordev_list.tqh_last (any later TAILQ_INSERT_TAIL would itself write through NULL).

Trigger: driver detach of a bound lm(4) on W83791SD hardware — kldunload/devctl detach/unbind (root). Reachable at runtime, not exploitable for anything but DoS; filed because the teardown path is fundamentally unguarded and the same shape fires for any future zero-sensor match entry.

Reproduce (lifted-copy harness — macro-level)

The in-kernel path needs the physical chip (guest has no LM78-class device), so the harness replicates struct ksensordev in a zeroed softc, the verbatim TAILQ_REMOVE from sys/sys/queue.h:646, and the install/deinstall list logic from kern_sensors.c.

./build.sh && ./run.sh

Expected (run.log): - CONTROL normal chip (numsensors=19, e.g. W83792D) → install → attach → detach clean, list intact - BUG zero-sensor attach (W83791SD path) → detach → SIGSEGV: kernel-equivalent NULL-pointer WRITE at 0x0 - PATCHED (fix.diff: numsensors == 0 guard) → same zero-sensor attach detaches cleanly

Fix validation

• fix.diff — git apply --check OK; one guard
• kernel-toolchain -fsyntax-only compile of the patched lm78.c in the X86_64_GENERIC kernel objdir: PATCHED_RC=0 with a deliberate-error negative control failing (NEGCTL_RC=1) — the check is real (fix_build.log); guest /usr/src restored

Files

• lm_detach_nullwrite.c (sha256 2efe60dd3d3e7e77e4d78e9061d741869c72f6fd87686a3d9562507cada2ddef)
• build.sh / run.sh, build.log / run.log / run.2.log / fix_run.log
• fix.diff, fix_build.log, env.txt, VERDICT.md, manifest.json, verdict.json

VERDICT — DF-4546

Reproduced: YES (lifted-copy harness, macro-faithful; in-kernel path hardware-gated)

• Root cause proven (lm78.c): wb_match() case WB_CHIPID_W83791SD (:590-592) sets a description but never calls lm_setup_sensors(), so sc->numsensors == 0; lm_attach() returns early at :427-429 before sensordev_install() (nothing is ever inserted into the global sensordev_list); lm_detach() (:450-451) unconditionally calls sensordev_deinstall(&sc->sensordev).
• Fault mechanics proven (kern_sensors.c:154-160 → sys/sys/queue.h:646-662): TAILQ_REMOVE on the zeroed, never-inserted node: tqe_next == NULL → sensordev_list.tqh_last = NULL (global list corrupted), then *(tqe_prev == NULL) = tqe_next → immediate write to virtual address 0. In the kernel that is an unrecoverable NULL-page write → panic. The harness replicates the exact macro expansion (verbatim from queue.h) and struct layout (sensors.h:156-166) in a calloc'd softc.
• Harness result (run.log): CONTROL (numsensors=19) installs and detaches cleanly; BUG (numsensors=0, the W83791SD path) → SIGSEGV: kernel-equivalent NULL-pointer WRITE at 0x0 inside sensordev_deinstall; PATCHED (fix.diff guard) → clean detach.
• Trigger realism: requires an lm(4) bound to a W83791SD and a privileged detach (kldunload / devctl). Root-triggered local DoS on rare hardware → severity Low. The defect is structural: any future match entry without a sensor table arms the same crash.

Fix validation

• git apply --check OK
• Kernel-toolchain -fsyntax-only of patched lm78.c in the X86_64_GENERIC objdir: PATCHED_RC=0 (0 bytes diagnostics) with a deliberate-syntax-error negative control failing (NEGCTL_RC=1) — fix_build.log; guest /usr/src restored + verified
• Harness PATCHED control: zero-sensor attach detaches without a fault

Kernel refs

sys/dev/powermng/lm/lm78.c:590, sys/dev/powermng/lm/lm78.c:427, sys/dev/powermng/lm/lm78.c:450, sys/kern/kern_sensors.c:153, sys/sys/queue.h:646, sys/sys/sensors.h:156, sys/dev/powermng/lm/lm78var.h:126

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.