DF-4610 — neomagic attach-failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec+softc (DF-4156 family, 13th instance).

BUILD (guest) cc -O -Wall -o /tmp/neomagic_probe /tmp/neomagic_probe.c

RUN (guest, any user) /tmp/neomagic_probe pciconf -l | grep 10c8 # absent on this guest (no NM256 in QEMU 7.2)

EXPECTED Probe prints the 4 trigger preconditions and exits 0; pciconf shows no 10c8:8005/8006 function. The UAF itself cannot be exercised here: it needs real NM256 hardware whose attach succeeds through mixer_init() and then fails at the IRQ/pcm_register step. Source chain and unwind walk-through: VERDICT.md.

FIX VALIDATION (build-only, on guest /usr/src copy) cd /usr/src && patch -p1 < fix.diff cd sys/dev/sound/driver/neomagic && make # -Werror, clean (see build.log)

DF-4610 — neomagic attach-failure paths after mixer_init() leave a live 0666 /dev/mixerN over freed codec+softc (DF-4156 family, 13th instance)

File: sys/dev/sound/pci/neomagic.c — pass 2 (GLM 5.3), 2026-09-22.

THE BUG

nm_pci_attach() (neomagic.c:663) publishes the mixer before anything that can still fail:

693:    codec = AC97_CREATE(dev, sc, nm_ac97);
694:    if (codec == NULL) goto bad;
695:    if (mixer_init(dev, ac97_getmixerclass(), codec) == -1) goto bad;   <-- 0666 /dev/mixerN goes live here
697:    sc->irqid = 0;
698:    sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irqid, RF_ACTIVE | RF_SHAREABLE);
700:    if (!sc->irq || snd_setup_intr(dev, sc->irq, 0, nm_intr, sc, &sc->ih)) {
702:        goto bad;                                                        <-- failure window #1
703:    }
...
709:    if (pcm_register(dev, sc, 1, 1)) goto bad;                          <-- failure window #2

mixer_init() (mixer.c:687-736) ends in pdev = make_dev(&mixer_ops, ..., 0666, "mixer%d") + pdev->si_drv1 = m (mixer.c:730-733) with m->devinfo = sc (the neomagic softc, via AC97_CREATE → ac97_create, ac97.c). The failure unwind then runs:

716: bad:
717:    if (codec) ac97_destroy(codec);        <-- kobj_delete(methods) + kfree(codec)  (ac97.c:852-858)
722:    kfree(sc, M_DEVBUF);                   <-- softc freed too

…without destroying the cdev or the snd_mixer. Every later open/ioctl on the surviving world-writable /dev/mixerN dispatches through mixer_ops into the freed snd_mixer → freed ac97_info (its methods kobj was deleted) → freed sc (e.g. nm_rdcd/nm_wrcd cast devinfo back to struct sc_info * and touch sc->reg, a released bus resource) — use-after-free with function-pointer-bearing kobj dispatch, exactly the DF-4156/4193/4299/4334/4344/4421/4457/4468/4504/4537/4550/4552 family.

Secondary unwind defect fixed in the same diff: bad: releases the two MEMORY resources (718-719) before bus_teardown_intr (720), so the handler could touch unmapped MMIO in between; the fix restores the canonical order (teardown irq, release irq, release mem).

THREAT

Unprivileged local user, provided the driver attached partially and then failed: the surviving /dev/mixerN is 0666 and its ioctls (OSS mixer_{g,s}et, MIXER_READ/WRITE, MIXERINFO, REINIT via resume…) immediately hit freed heap. Realistic failure triggers are bus_alloc_resource_any(SYS_RES_IRQ) failure (no free IRQ line / shareable-IRQ exhaustion) and pcm_register() failure (pcm_veto_load stuck, unit > PCMMAXUNIT — sound.c:1021/1027). Hardware-gated: requires an actual NM256AV (10c8:8005) / NM256ZX (10c8:8006) audio function.

VERIFICATION STATUS: untested (hardware-gated)

The audit guest runs QEMU 7.2.22, whose only audio device models are AC97 / ES1370 / intel-hda / sb16 — there is no NM256 emulation, so no snd_neomagic attach can occur there at all (env.txt: full pciconf -l, only hdac0 8086:2668 present; run.log: probe output). The code chain itself is fully source-proven above (confidence: certain).

• probe: neomagic_probe.c — prints the trigger preconditions and the guest hardware absence (build/run in run.log).
• fix build validation: fix.diff applied to the guest's /usr/src and snd_neomagic.ko rebuilt with -Werror — clean (build.log; canonical make in sys/dev/sound/driver/neomagic).

FIX

fix.diff (validated to apply+compile): move IRQ setup and pcm_register() before codec creation/mixer_init, destroy the codec inline when mixer_init() fails (nothing published yet in that case), leaving no failure path after the mixer is published (pcm_addchan/pcm_setstatus cannot fail); also fixes the bad:-unwind resource order.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.