DF-4875 — afd_describe() 1-byte stack NUL overflow via device-controlled mediasize

sys/dev/disk/nata/atapi-fd.c:446-451:

char sizestring[16];
if (fdp->mediasize > 1048576 * 5)
    ksprintf(sizestring, "%juMB", fdp->mediasize / 1048576);

mediasize (u_int64_t) is fully device-controlled: * READ_CAPACITY path (atapi-fd.c:384): (u64)be32toh(capacity) * blocksize → up to (2^32-1)^2 ≈ 1.84e19; * READ_CAPACITY_16 path (atapi-fd.c:396): be64toh(capacity) * blocksize computed in u64 (wraps mod 2^64) → any 64-bit value.

mediasize/1048576 can therefore have up to 14 decimal digits, and "%juMB" renders 14 + 2 + NUL = 17 bytes into char sizestring[16] — a 1-byte (NUL) stack buffer overflow at device attach time.

Proof

See proof.txt (generated by proof.c; pure arithmetic, host-side):

path1 READ_CAPACITY : cap=blocksize=0xFFFFFFFF -> '17592186036224MB' = 16 chars + NUL = 17 bytes -> OVERFLOW
path2 READ_CAP_16   : cap=2^64-1,blocksize=1   -> '17592186044415MB' = 16 chars + NUL = 17 bytes -> OVERFLOW

The lowest triggering mediasize is 10^13 MiB ≈ 1.05e19 (e.g. a device answering READ_CAPACITY_16 with capacity ≥ 2.44e16 sectors @512B, or READ_CAPACITY with maxed capacity+blocksize fields).

Status: untested (in situ) — proof is arithmetic

The write is deterministic the moment a (crafted, buggy or wedged) ATAPI floppy reports an oversized capacity; no runtime is needed to establish the 17 > 16 fact. On-guest execution is blocked because the audit guest cannot host an ATAPI direct-access device (QEMU 7.2: only ide-hd/ide-cd; see env.txt and the DF-4874 pack for the recorded blocker).

Impact ceiling

One NUL byte one past a 16-byte stack local in afd_describe(), at attach. Depending on compiler frame layout it can land on an adjacent local pointer (ch/atadev/fdp) and turn later device_printf derefs into a faulted pointer — a device-triggered kernel memory-corruption primitive of very limited range (fixed value 0x00, fixed position). Crafted-hardware class.

Fix

fix.diff (git-apply-able, checked): enlarge to char sizestring[32] and switch to ksnprintf() with the buffer size so no device input can ever overflow it.

DF-4875 VERDICT — afd_describe() 1-byte stack NUL overflow

Status: untested in situ (no ATAPI direct-access hardware on guest); mathematically certain

Root cause (path:line)

• afd_describe() declares char sizestring[16] (sys/dev/disk/nata/atapi-fd.c:446) and formats the device-reported media size with an unbounded ksprintf(sizestring, "%juMB", fdp->mediasize / 1048576) (atapi-fd.c:448-449) — reached whenever mediasize > 5 MiB.
• fdp->mediasize is attacker(device)-controlled 64-bit:
• READ_CAPACITY: fdp->mediasize = (u_int64_t)be32toh(capacity.capacity) * fdp->sectorsize (atapi-fd.c:384) — product up to (2^32-1)^2 ≈ 1.84e19;
• READ_CAPACITY_16: fdp->mediasize = be64toh(capacity_big.capacity) * fdp->sectorsize (atapi-fd.c:396) — u64 multiply, wraps to any value.
• Max rendered length: (2^64-1)>>20 = 17592186044415 → 14 digits → "17592186044415MB" + NUL = 17 bytes into a 16-byte stack array.

Why certain without a run

The proof is pure arithmetic on the exact types involved (proof.txt, regenerable via proof.c): both capacity paths demonstrably produce mediasize ≥ 1.049e19 from well-formed device responses, and ksprintf/vsnprintf semantics write exactly strlen+1 bytes. There is no code path that clamps mediasize before afd_describe() is called at attach (atapi-fd.c:130). What a run could only add is the identity of the stack slot clobbered by the 17th byte — that depends on compiler frame layout, not on the bug.

In-situ blocker (documented, not a refutation)

afd_describe() runs only from afd_attach() (atapi-fd.c:130), which runs only for ATAPI direct-access devices (atapi-fd.c:90-91). QEMU 7.2 provides no ATAPI direct-access emulation (-device help lists only ide-hd, ide-cd), so no afd device can attach on the audit guest. Recorded in the DF-4874 pack (run.log: "afd0 device_t is NULL").

Impact

Single NUL byte written one past a 16-byte stack local at driver attach — a real kernel stack memory-corruption bug (CWE-787) with a hostile-device precondition and very constrained primitive (value 0x00, fixed offset, attach-time only). Worst realistic outcome: corrupted adjacent local pointer (ch/atadev/fdp at atapi-fd.c:443-445) → faulted deref inside device_printf (atapi-fd.c:455-458) → kernel panic; escalation to controlled exploitation is not plausible with a fixed 0x00 byte.

Fix validation

fix_status: not_testable — the trigger device cannot exist on the audit guest (see above); the fix (sizestring[32] + ksnprintf with size, fix.diff) removes the overflow by construction (bounded formatting API, buffer larger than the 17-byte worst case).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.