DF-4847 — feeder_matrix.c FXROUND align-overshoot (evidence pack)

What this proves

The REAL, UNMODIFIED sys/dev/sound/pcm/feeder_matrix.c sizes its feed window with the inexact generated SND_FXROUND/SND_FXDIV macros (see DF-4846 for the table defect — misround-up within the claimed [1,65536] domain from x≈5.4K for align 14, x≈8.2K for align 12, 15–40% of counts):

• :479 count = SND_FXROUND(count, info->oalign) misrounds past the caller's count → pass sized past the destination window.
• :501 (ialign>oalign, e.g. 7ch→5ch) j = SND_FXROUND(count - oalign, ialign) misrounds ⇒ j can exceed count−oalign by up to ialign−1 ⇒ src = dst + count - j before the window start AND the source ask window exceeds the destination.
• :509 SND_FXDIV(FEEDER_FEED(...), ialign) miscounts frames on partial (user-paced) source returns.

The pass-2 soak that previously cleared this file (220k iterations) did not drive the bad-residue count values; this harness enumerates them exactly.

Build / run (guest)

cd /root/fx && sh build.sh && ./ffmat    # baseline: FAIL (4891/23706)
# fixed generator:
cp snd_fxdiv_gen_fixed.h snd_fxdiv_gen.h && cc -O1 -g -o ffmat_fixed ffmat.c fxsrc.c
./ffmat_fixed                            # ALL PASS

Expected output

mat.log: ffmat: checks=23706 failures=4891 -> FAIL, decisive lines: FAIL[T2 upmix ialign=4<oalign=12] in_ch=2 out_ch=6 count=8195 ret=8184 REAR guard (write past window) maxwrite_off=8196 maxask=2728.

In-kernel reachability

feeder_matrix inserted on any channel-count mismatch (feeder_chain.c:284-336, use_matrix when feeder_matrix_compare(origin,target) != 0) — an unprivileged SNDCTL_DSP_CHANNELS choice; counts from buffer.c:705-709 as in DF-4846. In-kernel churn logs in the DF-4849 pack.

Fix

fix.diff (shared generator fix). A/B: baseline 4891 failures → fixed 0.

DF-4847 — VERDICT

status: reproduced (feeder level, real unmodified code on the audit guest) primitive: up to ialign−1 byte OOB write past the destination window (including window-preceding underwrite via the :501 misround) + return over-report into sndbuf_acquire (ring overflow) confidence: certain

Root cause

Shared table defect (snd_fxdiv_gen.awk calcdiv single-point validation — see DF-4846 VERDICT for the exhaustive enumeration) consumed on the caller's window by feed_matrix_feed:

• feeder_matrix.c:479 count = SND_FXROUND(count, info->oalign) — misround ⇒ count' > count: the source fill and matrixing pass are sized past the window.
• :494-506 for ialign>oalign: j = SND_FXROUND(count - info->oalign, info->ialign) — misround ⇒ j up to count+ialign−oalign−1 > count ⇒ src = dst + count - j < dst — the source writes BEFORE the destination window and past its end.
• :509 SND_FXDIV(FEEDER_FEED(...), ialign) — frame miscount on partial user-paced returns; apply() then processes frames the source never delivered.

Reproduction (guest, pristine file)

ffmat (mat.log): checks=23706 failures=4891, decisive:

FAIL[T2 upmix ialign=4<oalign=12] in_ch=2 out_ch=6 count=8195 ret=8184 REAR guard (write past window) maxwrite_off=8196 maxask=2728

count=8195 is the first bad value for align 12 (FXROUND(8195,12)=8196): a 2ch→6ch upmix writes past the 8195-byte window (maxwrite_off 8196).

Note: the previous pass-2 result for this file ("clean, 220k iterations") did not include the bad-residue count enumeration; the defect is deterministic arithmetic, not timing.

Kernel reachability

feeder_build_matrix (feeder_chain.c:284-336) on any channel-count mismatch — unprivileged SNDCTL_DSP_CHANNELS (2↔6/7 etc.); default chain. Counts as in DF-4846 (buffer.c:705-709). In-kernel churn: no differential anomaly vs aligned control on this no-INVARIANTS kernel (DF-4849 pack logs) — same reasoning as DF-4710/DF-4846.

Fix validation

fix.diff (generator, shared): baseline 4891 failures → fixed 0 (ALL PASS) (mat.log vs mat_fixed.log). Fixed table exhaustively exact for all 44 divisors over [1,65536]. fix_status: fixed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.