DF-4611 — nm_init() programs ring/coeff buffers from unvalidated card-provided buftop: cbuf/rbuf/pbuf/acbuf wrap to ~0xffffxxxx and later nm_wrbuf()/sndbuf_setup() write at wild offsets.

BUILD (guest, portable userland) cc -O -Wall -o /tmp/buftop_prover /tmp/buftop_prover.c

RUN (guest, any user) /tmp/buftop_prover

EXPECTED Table of hostile buftop values → wrapped offsets, e.g. buftop=0xffffed00 pbuf=0xffff1d00 "WRAPS -> ~4G OOB bus_space offset" plus the derived minimum sane buftop 0x1b960. Full output: run.log. Kernel-side trigger needs real NM256 hardware (absent: env.txt).

FIX VALIDATION (build-only, on guest /usr/src copy) cd /usr/src && patch -p1 < fix.diff cd sys/dev/sound/driver/neomagic && make # -Werror, clean (see build.log)

DF-4611 — nm_init() programs ring/coeff buffers from unvalidated card-provided buftop → wrapped (≈4G) bus_space offsets

File: sys/dev/sound/pci/neomagic.c — pass 2 (GLM 5.3), 2026-09-22.

THE BUG

nm_init() (neomagic.c:541) derives every buffer offset from sc->buftop, and lets the card override it with an arbitrary 32-bit value read out of its buffer-memory signature block:

562:    sc->buftop = (nm_rd(sc, 0xa0b, 2)? 6144 : 4096) * 1024;   /* ZX */
571:    ofs = sc->buftop - 0x0400;
572:    sc->buftop -= 0x1400;
576:    if ((nm_rdbuf(sc, ofs, 4) & NM_SIG_MASK) == NM_SIGNATURE) {
577:        i = nm_rdbuf(sc, ofs + 4, 4);
578:        if (i != 0 && i != 0xffffffff) {
581:            sc->buftop = i;             <-- unvalidated card value
582:        }
583:    }
585:    sc->cbuf  = sc->buftop - NM_MAX_COEFFICIENT;   /* -0x5000 */
586:    sc->rbuf  = sc->cbuf  - NM_BUFFSIZE;           /* -0x4000 */
587:    sc->pbuf  = sc->rbuf  - NM_BUFFSIZE;
588:    sc->acbuf = sc->pbuf  - (NM_TOTAL_COEFF_COUNT * 4);   /* -0xC560 */

A sane buftop is 4–6 MB, so nothing checks the arithmetic. A defective or hostile card returning a small i makes cbuf/rbuf/pbuf/acbuf wrap to ~0xffffxxxx: every later

• nm_wrbuf(sc, sc->cbuf + i, coefficients[ofs+i], 1) for i < 0x5000 (nm_loadcoeff, neomagic.c:314 — runs at the first setformat/speed), and
• sndbuf_setup(b, rman_get_virtual(sc->buf) + chnbuf, NM_BUFFSIZE) (nmchan_init, neomagic.c:362 — makes every user write() memcpy ~4 GB past the BAR mapping)

…becomes a wild kernel-side write at a card-chosen offset below/around the mapping. Minimum legitimate buftop = 0x1400+0x5000+2×0x4000+0xC560 = 0x1b960; see buftop_prover.c output in run.log for the wrapped offsets produced by hostile values (e.g. buftop=0x100 → pbuf=0xffff1d00).

THREAT

Requires physical NeoMagic NM256 hardware whose buffer signature block returns a crafted i (defective NVRAM, or a hostile PCIe device spoofing the 10c8:8005/8006 IDs). Attacker class = malicious/failed hardware, not an unprivileged user; impact = kernel memory corruption at attach/first use (steerable-offset wild write), realistically a panic.

VERIFICATION STATUS: untested (hardware-gated)

No NM256 device model exists in QEMU 7.2 (env.txt), so the kernel-side write cannot be triggered on the audit guest. The arithmetic is proven by the userland prover (buftop_prover.c, run.log) and the code path by the citations above (confidence: certain for the defect; speculative for real-world exploitation).

• fix build validation: fix.diff (range-check buftop ≥ 0x1b960 before use) applied to the guest's /usr/src and snd_neomagic.ko rebuilt with -Werror — clean (build.log).

FIX

fix.diff: reject implausible buftop (< 0x1b960) with a diagnostic and attach failure — same defensive posture DF-1371 established for firmware-misreported geometry.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.