DF-4849 — feeder_mixer.c FXROUND ring overflow + mcnt-underflow memset bomb

What this proves

The REAL, UNMODIFIED sys/dev/sound/pcm/feeder_mixer.c:

• M1 (:299) count = SND_FXROUND(count, sz) misrounds PAST the caller's free space for bad-residue values inside the claimed domain (first bad 8195 for sz=12). Children fill count > free bytes into b and the mixer RETURNS rcnt > free — in-kernel sndbuf_acquire(to, tmpbuf, rcnt) then overflows the ring (buffer.c:615-636, KASSERT-only in production; rl inflates past bufsize, sndbuf_getfree = bufsize - rl wraps unsigned). 500/500 M1 checks fail.

• M2 (:339-364, :362, :368) when a child feeder returns more than asked (proven possible in-tree by DF-4846/DF-4848: feeder_format/feeder_volume return count+delta on the same misrounds), rcnt = SND_FXROUND(ret, sz) exceeds count and mcnt = count - rcnt underflows to ~0xFFFFfffX, then :368 executes memset(b + rcnt, zerodata, ~4GiB) — catastrophic heap overwrite. The harness catches the exact call:

MEMSET-BOMB: memset(b + 65556, 0x00, 4294967284) [mixer count window was 65544]

(exit code 42). This is a vchan-mixing default path: snd_maxautovchans = 16 by default — any two /dev/dsp opens mix through feed_mixer_feed.

Build / run (guest)

cd /root/fx && sh build.sh && ./ffmix    # exit=42 (memset bomb), M1 500 fails
cp snd_fxdiv_gen_fixed.h snd_fxdiv_gen.h && cc -O1 -g -o ffmix_fixed ffmix.c fxsrc.c
./ffmix_fixed                           # ALL PASS, no bomb

In-kernel churn artifacts

churn_bad.log / churn_dmesg.txt (ES1370, 6ch+7ch vchan children, bad-residue-paced writes): no differential anomaly vs the aligned control (ctlchurn.c) on this no-INVARIANTS production kernel; the observed "play interrupt timeout, channel dead" occurs equally in the control run (ES1370-without-audiodev artifact, not attributable to the defect).

Fix

fix.diff (shared generator fix). A/B: baseline M1 500 fails + bomb → fixed ALL PASS, no bomb. Defensively, :362 should also clamp (if (rcnt > count) rcnt = count;) so no child misbehavior can ever arm the giant memset.

DF-4849 — VERDICT

status: reproduced (feeder level, real unmodified code on the audit guest) primitive: (M1) persistent sndbuf ring overflow — mixer returns more bytes than the destination has free; (M2) mcnt unsigned underflow arming a ~4GiB memset at b + rcnt — caught verbatim by the harness: MEMSET-BOMB: memset(b + 65556, 0x00, 4294967284) confidence: certain (M1 direct on pristine code; M2 mixer logic proven on pristine code with the child-overshoot precondition demonstrated separately on real feeder_format/feeder_volume code — DF-4846/DF-4848)

Root cause

feed_mixer_feed (feeder_mixer.c:279-388):

1. :299 count = SND_FXROUND(count, sz) — the caller (sndbuf_feed, buffer.c:708) passes count = min(free, maxfeed); for bad-residue free values (first bad 8195 for sz 12; 15–40% of values ≥ first_bad) the generated table misrounds UP (shared snd_fxdiv_gen.awk defect — see DF-4846), so count > free. Children are asked for count and fill it into b; the mixer returns rcnt = count > free. Kernel side: sndbuf_acquire(to, tmpbuf, rcnt) with rcnt > free copies past the free region (ring overwrite of live audio) and inflates b->rl past b->bufsize — sndbuf_getfree = bufsize - rl then wraps unsigned (buffer.c:615-636; only KASSERT-protected in production).

2. :339-364 rcnt = SND_FXROUND(FEEDER_FEED(ch->feeder, ...), sz) — the FXROUND of a child's return. If the child returns more than asked (count + delta — exactly what DF-4846 proves feeder_format does and DF-4848 proves feeder_volume does on the same misrounds), rcnt can exceed count, and :362 mcnt = count - rcnt underflows (e.g. 65544 − 65556 → 0xFFFFFFF4 = 4294967284). :368 then executes memset(b + rcnt, sndbuf_zerodata(...), mcnt) — a ~4GiB kernel heap memset 12 bytes past the window base — total memory destruction (panic at best).

Reproduction (guest, pristine file)

ffmix (mix.log):

FAIL[M1 ring overflow] count_in(free)=8195 FXROUND=8196 rcnt=8196  (+1 bytes past free)   [500/500]
M2: child0 (feeder_format-style) returns count+8; FXROUND(65544+8, 12) = 65556 > count 65544
MEMSET-BOMB: memset(b + 65556, 0x00, 4294967284) [mixer count window was 65544 => mcnt underflow]

exit code 42. The M2 child stub returns count+8 — a delta class the fxfmt/ffvol harnesses produce from REAL feeder code (e.g. feeder_format count=65548 → 65556).

Kernel reachability

• Vchan mixing is default: snd_maxautovchans = 16 (sound.c:62); every pair of /dev/dsp opens becomes children of one parent mixed by feed_mixer_feed (feeder_mixer.c:314-380). The parent format follows the first child (vchan sync), giving non-pow2 sz (12/14) via unprivileged channel ioctls.
• M1 needs only: free landing on a bad residue ≥ 8195 (user-paced drain) — a large fraction of feeds on 8K–64K buffers.
• M2 needs the additional conjunction of an overshooting child head feeder (DF-4846/DF-4848-proven) and ≥ 2 busy children — all unprivileged, default-config choices.

In-kernel attempt (honest)

ES1370 + 6ch/7ch vchan children + bad-residue pacing (churn_bad.log, churn_dmesg.txt): the "channel dead" events occur equally in the ALIGNED CONTROL run (ctlchurn.c) — an ES1370-without-audiodev emulation artifact, not differential, so no in-kernel anomaly is attributable to the defect on this no-INVARIANTS rig — the expected outcome for ring-level overflow (silent) and the memset (would be instantly fatal if its composite conjunction fired; it did not on this rig within the bounded churn).

Fix validation

fix.diff (generator): baseline = M1 500/500 fails + memset bomb (exit 42); fixed = 0 failures, no bomb (mix.log vs mix_fixed.log). fix_status: fixed. Recommended hardening independent of the generator: clamp rcnt to count at :362 (if (rcnt > count) rcnt = count;) so no feeder-contract violation anywhere in the tree can ever arm the giant memset.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.