DF-4764 — hptmv type confusion in hpt_get_info (goto is_array passes RAID-1 member disk) → kernel SIGFPE panic on unprivileged sysctl hptmv.status read

File: sys/dev/raid/hptmv/hptproc.c (pass 2) Bucket: local DoS (panic) via world-readable sysctl; secondary adjacent-memory misparse.

What this pack contains

• h1_harness.c — KLD harness built on the audit guest against the real driver headers (<dev/raid/hptmv/global.h>). Embeds verbatim copies of hpt_copy_array_info (hptproc.c:402-478), hpt_copy_disk_info (:372-399), get_disk_name (:339-349) and the hpt_get_info device-list loop (:515-549). CTASSERTs prove the union layout the analysis relies on.
• triggers:
• 1 = DF-4764 baseline (expect panic)
• 2 = DF-4765 baseline (expect panic)
• 3 = DF-4766 baseline (expect overread output)
• 4/5/6 = fixed variants (fix.diff applied to the copies; expect survival)
• build.sh / run.sh, build.log, run.log (H1 panic), run.2.log (H2 panic), run.3.log (H3 overread), run.fixed.log (H1F/H2F/H3F), panic.txt, env.txt, fix.diff, manifest.json, verdict.json.

Build

On the DragonFly guest (kernel source at /usr/src):

mkdir -p /root/h1 && cp h1_harness.c /root/h1/
printf 'SYSDIR=\t/usr/src/sys\nKMOD=   h1harness\nSRCS=   h1_harness.c\nCFLAGS+= -I/usr/src/sys\n.include "/usr/src/sys/conf/kmod.mk"\n' > /root/h1/Makefile
cd /root/h1 && make SYSDIR=/usr/src/sys

Run

kldload /root/h1/h1harness.ko
sysctl h1harness.trigger=1     # DF-4764 baseline: panics the guest
# after vm.sh reset with-src: reload, then
sysctl h1harness.trigger=4     # DF-4764 fix: survives

Expected output (baseline trigger 1, from run.log)

H1:   bArnMember     = df_on_line    = 1
H1:   rf_broken      = bit16(dDeRealCapacity) = 0
H1:   rf_rebuilding  = bit21(dDeRealCapacity) = 1
H1:   pMember[0]     = Device.mv    = 0xffffffff82607140
Fatal trap 18: integer divide fault while in kernel mode
Stopped at hpt_copy_array_info.constprop.3+0x130: divq %rdi,%eax

Honest scope note

The mechanism (verbatim kernel function, real driver structs, verbatim call path including the buggy hptproc.c:535 goto) is reproduced on the guest. End-to-end reachability through the live sysctl additionally requires hptmv controller hardware with a RAID-1 array whose source disk remains listed in _vbus_p->pVDevice[] — the exact state the driver's own comment at hptproc.c:530-533 describes. No hptmv controller exists on the audit guest, so the live path was verified statically (see VERDICT.md). The sysctl itself is present and world-readable on the guest (hptmv.status).

DF-4764 VERDICT

Status: REPRODUCED (mechanism, source+harness on guest) — kernel panic (SIGFPE) via type confusion on an unprivileged sysctl read path; end-to-end detonation needs hptmv hardware (absent from guest), statically established.

The bug

sys/dev/raid/hptmv/hptproc.c:515-549 — hpt_get_info() walks the VBus logical-device list. For each _vbus_p->pVDevice[i] that is not itself an array but has been added to a RAID-1 after driver load (the driver's own comment at :530-533: "it may be add to an array after driver loaded, check it"), the code jumps into the array-display branch:

534:  if (pVDev->pParent->VDeviceType==VD_RAID_1 && pVDev==pVDev->pParent->u.array.pMember[0])
535:      goto is_array;            /* ← passes the member DISK */
...
523:  is_array:
524:      hpt_copy_array_info(pinfo, j, pVDev);

The label invokes hpt_copy_array_info() with the member disk, not with pVDev->pParent. VDevice.u is a union of RaidArray and Device (vdevice.h:71-76), so the disk's fields are re-parsed as array fields (LP64 layout proven by CTASSERT in the harness, matching array.h:54-99 / global.h:70-88 / vdevice.h):

In hpt_copy_array_info, with sStatus still NULL (online, bit16=0), the member loop runs bArnMember = 1 time; mIsArray(pMember[0]) dereferences the mv channel pointer (valid, so no fault), reading its first byte (channelNumber ≤ 3 on RR18xx → false) so pTmpArray = pArray (the disk); then bit21/bit22 of the disk capacity is read as rf_rebuilding / rf_verifying and the "Rebuilding/Verifying %" ksprintf at hptproc.c:457/462 divides by

(pTmpArray->VDeviceCapacity / (pTmpArray->u.array.bArnMember - 1)) >> 11

with bArnMember = df_on_line = 1 → x / 0 → integer-divide trap (#DE) in kernel mode → panic.

Disk sizes with bit16=0 and bit21 or bit22 set detonate; e.g. the common 1 TB sector count 0x7470DA70 (bit16=0, bit21=1, bit22=1), 500 GB 0x3A38A5D0 (bit16=0, bit21=1) — roughly half of all capacities. Sizes with bit16=1 instead display "Critical" (no crash); sizes with bits 21/22 clear print a garbage row (misparse of live kernel objects, plus ArrayName read from u+104 past the 48-byte disk union tail).

Trigger

Unprivileged: sysctl hptmv.status (world-readable sysctl; confirmed on the guest — unprivileged read works, unprivileged write is EPERM via kern_sysctl.c:1446). Precondition: a RocketRAID 18xx system whose admin built a RAID-1 whose source disk remains enumerated (the state hptproc.c:530-535 explicitly handles).

Reproduction (guest, DragonFly 6.5-DEVELOPMENT #0, cc 8.3)

• h1harness.ko built against /usr/src/sys with the real driver headers; CTASSERT layout proof passed at load.
• sysctl h1harness.trigger=1 → exact predicted state printed, then Fatal trap 18: integer divide fault while in kernel mode, Stopped at hpt_copy_array_info.constprop.3+0x130: divq %rdi,%eax (run.log, panic.txt). Guest down.
• Fix variant (trigger 4, pVDev = pVDev->pParent per fix.diff): renders the proper RAID-1 row and survives (run.fixed.log).

Reachability gap (honest)

The live path sysctl hptmv.status → hpt_status → hpt_get_info → (arrays present) requires hptmv controller hardware. The audit guest has none (hptmv.status prints only the driver-version line — gIal_Adapter is NULL), so the final hop (real RAID-1 on real hardware) is static: hptproc.c:530-533's comment documents that member disks stay listed in pVDevice[]; the whole pParent/pMember[0] special-case exists only because of it. Everything downstream of that state was executed verbatim in the guest kernel via the harness.

Kernel references

• sys/dev/raid/hptmv/hptproc.c:523-535 (buggy goto), :444-463 (loop + div)
• sys/dev/raid/hptmv/vdevice.h:71-76 (union), :80-81 (sizes)
• sys/dev/raid/hptmv/array.h:54-99 (RaidArray layout incl. rf bit order)
• sys/dev/raid/hptmv/global.h:70-88 (Device layout)
• sys/kern/kern_sysctl.c:1446-1447 (write privilege; read unrestricted)

Recommended fix

Pass the parent array (fix.diff): pVDev = pVDev->pParent; goto is_array;. Validated in-harness: trigger 4 survives. Also harden the % (DF-4765) and the name terminator (DF-4766).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.