DF-4692 — sili_pm: sili_pm_read / sili_pm_write / sili_pm_set_feature dereference unchecked sili_ata_get_xfer() NULL — kernel panic on ccb-pool exhaustion

Build & run

sh build.sh          # cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c
sh run.sh            # ./trigger_sili_pm 15  (camcontrol reset/rescan storm)

Expected output

• On hardware with a SiI 3124/3132 HBA + SiL3726 PM, port saturated with I/O: any hot-plug async-notify event (or the periodic PM state machine pass) makes the port thread call sili_pm_read(ap, 15, SATA_PMREG_EINFO, …) (sili.c:530) / sili_pm_check_good() (sili.c:580,654 → sili_pm.c:584,589,610). With every command slot busy, sili_ata_get_xfer() returns NULL (sili.c:2322-2327) and xa->fis->type = … (sili_pm.c:645) faults the NULL direct-map page → kernel panic.
• On the audit QEMU guest: trigger builds and runs to completion against ata0/ata1 (no sili HBA exists; see env.txt) — the defective code is never reached. This is a hardware gate, not a false positive.

Root cause chain (path:line)

1. sili_get_ccb() returns NULL when ap_ccb_free is empty — sili.c:2008-2014.
2. sili_ata_get_xfer() propagates the NULL — sili.c:2322-2327.
3. sili_pm_set_feature() dereferences without check — sili_pm.c:549-551.
4. sili_pm_read() dereferences without check — sili_pm.c:643-645.
5. sili_pm_write() dereferences without check — sili_pm.c:680-682.
6. Live entries: PM hot-plug state machine EINFO poll (sili.c:530), sili_pm_check_good() (sili_pm.c:584,589), sili_pm_identify() (sili_pm.c:170-217), sili_pm_hardreset() (sili_pm.c:283-340).

Same defect class as DF-4237 (sili_cam.c, pass 1) — three further unchecked instances in this file.

VERDICT — DF-4692

Status: inconclusive (hardware-gated) · code-path proven · expected impact: kernel panic (local DoS)

Reproduced?

No — and provably not runnable on this guest: the audit QEMU guest has no SiI 3124/3132 HBA (PCI inventory in env.txt: PIIX3 IDE + virtio only, 7 devices) and QEMU does not emulate the SiL3726 port multiplier, so sili(4) never attaches (dmesg has zero "sili" lines) and sili_pm_* is unreachable at runtime. The trigger builds (build.log) and runs (run.log): 24+ XPT_RESET_DEV / rescan operations were driven against the only buses present (ata0/ata1, nata driver) — benign, as expected when the sink is absent. This is the same evidence standard as the accepted DF-4502/DF-4503 sibling packs.

Why the defect is real (trace)

1. sili_get_ccb() — sili.c:2003-2018 — returns TAILQ_FIRST(&ap->ap_ccb_free) unchanged when the free list is empty, i.e. NULL is a designed return.
2. sili_ata_get_xfer() — sili.c:2317-2337 — propagates it: if (ccb == NULL) { DPRINTF("NULL ccb"); return (NULL); } (:2322-2327).
3. sili_pm_set_feature() — sili_pm.c:549-551: xa = sili_ata_get_xfer(ap, &ap->ap_ata[15]); xa->fis->type = … — no check.
4. sili_pm_read() — sili_pm.c:643-645 — same unchecked deref.
5. sili_pm_write() — sili_pm.c:680-682 — same unchecked deref. On NULL xa, xa->fis loads from ~offset 0x10 of the direct map → supervisor fault on the NULL page → kernel panic.

Reachability of pool exhaustion on a PM port

The port-thread PM state machine issues sili_pm_read(ap, 15, EINFO) on every hot-plug notification pass (sili.c:529-534) and sili_pm_check_good() performs up to three further PM accesses per event (sili_pm.c:584, 589, 610). These run under the port lock, but commands issued before the event still occupy slots (ap_active). CAM I/O and PM maintenance are not mutually exclusive (sili_cam_action() issues under ap_sim_lock, sili_cam.c:122/202), so a saturated port (all SILI_MAXCMDS slots busy — e.g. NCQ depth against a PM with several disks) plus one async-notify interrupt yields NULL at step 3/4/5. ata_xfer has no reserved slot for PM maintenance (the err_ccb reservation is only for error recovery, sili.c:2033-2050).

This is the same class as DF-4237 (sili_cam.c probe NULL deref, pass 1, Medium) — three additional unchecked instances live in this file, including the periodic EINFO poll that re-fires on every hot-plug event.

Realistic impact ceiling

Kernel panic (unprivileged trigger: any user keeping the disks busy while a hot-plug event / camcontrol rescan lands). No write primitive — NULL-page read/write fault. Severity Medium, consistent with DF-4237.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.