DF-4675

bktr_detach removes only the minor==unit device node — /dev/tunerN (unit+16) and /dev/vbiN (unit+32) persist after detach, stranding cdevs that reference the driver's dev_ops (use-after-free after module unload)

Summary

Attach creates three nodes (unit, unit+16, unit+32) but detach's minor-match removes only the exact unit; stale nodes return ENXIO while attached but post-kldunload dispatch through freed dev_ops. Remove-all-three-minors fix.

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-668
File: sys/dev/video/bktr/bktr_os.c
Lines: 325-367
Area: dev
Discovered: 2026-09-22
Updated: 2026-09-22

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: bktr_detach removes only minor==unit - /dev/tunerN and /dev/vbiN persist, stranding cdevs referencing the driver's dev_ops (dev_ops UAF after module unload)
Confidence: certain
Tested: 2026-09-22 19:24:18
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-09-22 19:24:18
Runtime: —
Kernel: per-fix-DF-4675
fix.diff: findings/poc/DF-4675/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4675 · 1 files

File	Type	Description	Size
verdict.json	file		865 B	view raw

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: hardware-gated (no Bt848 / no CardMan on guest)

fix in finding markdown

per-fix-DF-4675

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

devfs minor-match misses the +16/+32 aliases. Remove-all-three-minors fix.

Verdict

not_run: Info lifecycle defect; root/hot-removal gated