DF-4952 — VERDICT

status: reproduced (feeder level, real unmodified feeder_mixer.c + feeder_matrix.c + real generated snd_fxdiv_gen.h on the audit guest, md5-verified against the audit tree) primitive: linear heap OOB write past bufsoft->tmpbuf — continuous maxfeed-sized (~64KB) writes from the tmpbuf base while the window is only round_page(bufsize) (~20KB); rear-guard smash measured to offset 45064 with 44367 corrupted bytes, repeated every loop pass. confidence: certain

Root cause — a NEW sink, distinct from DF-4849 (which is :299-368, the PLAY path)

feed_mixer_rec (sys/dev/sound/pcm/feeder_mixer.c:177-277), the REC dispatch of the same feeder DF-4849 filed for the PLAY path:

:194  cnt = sndbuf_getsize(b);
:195  maxfeed = SND_FXROUND(SND_FXDIV_MAX, sndbuf_getalign(b));   /* ~64KB */
:197  do {
:198      cnt = FEEDER_FEED(c->feeder->source, c, b->tmpbuf,
:199          min(cnt, maxfeed), c->bufhard);
:200      if (cnt != 0) {
:201          sndbuf_acquire(b, b->tmpbuf, cnt);   /* KASSERT-only guard */
:202          cnt = sndbuf_getfree(b);
:203      }
:204  } while (cnt != 0);

1. The feeder directly below the REC mixer (feed_matrix here — or feed_format; both proven over-returners on real code, DF-4847/DF-4846) returns count+delta for bad-residue requests (entry SND_FXROUND(count, oalign) misround, in-tree generator: FXROUND(16390,12)=16392). count was min(bufsize, maxfeed) ≤ free, so sndbuf_acquire(count+delta) with free == bufsize inflates b->rl past b->bufsize — buffer.c:615-635 only KASSERTs, compiled out on the production guest (X86_64_GENERIC, no INVARIANTS).
2. sndbuf_getfree(b) = bufsize - rl (buffer.c:519-525) now wraps to ~0xFFFFxxxx.
3. min(cnt, maxfeed) == maxfeed (~65532/65544) is then requested into b->tmpbuf, an allocation of only round_page(bufsize) bytes (buffer.c:180-195). The PLAY caller (chn_wrfeed, channel.c:425-427) clamps its request by sndbuf_getsize(); feed_mixer_rec has no such clamp — the loop trusts the wrapped free.
4. The converter (real feed_matrix_feed) computes src = dst + count - j (~44KB past tmpbuf — the root stub, emulating feed_root/sndbuf_dispose, writes where told) and writes the whole converted block at dst: 65544 bytes from the tmpbuf base into a 20480-byte window → 45064 bytes past the end of the heap allocation, with format-converted capture content. The wrapped free never drains, so the loop re-issues maxfeed requests every pass until the hardware side dries up.

Distinctness from DF-4849: different function (REC vs PLAY), different sink (linear heap OOB write via maxfeed re-request vs ring-wrap + mcnt memset bomb), different caller-clamp gap. Same family ROOT (the snd_fxdiv_gen.awk reciprocal defect, DF-4846-4849) — the generator fix clears it, but the filed DF-4849 hardening (:362 clamp) does NOT cover this sink; this finding's fix.diff clamps the REC acquire (and also carries the :362 clamp).

Reproduction (guest, pristine files, in-tree generator)

./ffrec → exit 42:

bufsoft: bufsize=16390 (bad residue: FXROUND(16390,12)=16392 > 16390)  tmpbuf allocsize=20480  maxfeed=65544
ACQUIRE-OVER: count=16392 free=16390 (rl=0 size=16390) -- KASSERT compiled out, rl -> 16392
REAR-GUARD SMASHED: window=20480 first_oob=0 farthest=45064 smashed_bytes=44367

(root max write offset prints a wrapped sentinel — it includes writes to the matrix's own reservoir kmalloc which sits below the window base; cosmetic harness noise, not part of the proof. The decisive metric is the rear-guard smash of the tmpbuf window.)

Kernel reachability (unprivileged)

• REC vchan parents are default: snd_maxautovchans = 16 (sound.c:62) covers capture; any /dev/dsp open for record on a device with capture caps becomes a vchan child of a REC parent mixed through feed_mixer_rec (feeder_chain.c:832-833).
• The first capture child sets the parent format (vchan_sync), e.g. S16_LE 6ch → parent sz/align 12 while the hardware side is 2ch — the feed_matrix conversion below the mixer with oalign 12 (non-pow2 → misround windows).
• bufsoft sizes are latency-profile derived (chn_setlatency → sndbuf_resize(blkcnt, blksz)) — non-pow2 values like 16390 are formable (blksz 8195 × blkcnt 2); landing the FIRST request on a bad residue is the same probability class DF-4846-4849 measured (15-40% of values ≥ first_bad ≈ 8195).
• Content: format-CONVERTED capture data (up-mixed 2ch→6ch), attacker influenced through whatever the ADC/backend records; size is attacker-paced (drain rate).

Fix validation (three-way, on the guest)

fix.diff (this pack) clamps the REC acquire (feeder_mixer.c:200-203) so b->rl can never pass b->bufsize — kills the sink independently of the generator fix — and also carries the DF-4849-recommended :362 rcnt > count clamp so no feeder-contract violation anywhere in the tree can arm the PLAY-path mcnt memset. fix_status: fixed (baseline_reproduced=1, patched_reproduced=0).

The pass-2 follow-up question (orchestrator): post-generator-fix, is DF-4849's mcnt underflow reachable via any OTHER over-return source?

No. Exhaustive walk of every feeder that can sit at a vchan child chain head (or below the REC mixer), all against the fixed generator:

• feed_root (feeder.c:456-508): PLAY returns exactly count (zeropads), REC returns min(count, ready) — never over-returns, generator-independent.
• feed_format (DF-4846), feed_matrix (DF-4847), feed_volume (DF-4848): over-return was solely the entry/exit FXROUND misround; fixed-generator A/B in the family packs = 0 failures across all (count, align) combos.
• feed_eq (DF-4710): same generator root (SND_FXDIV of the child return advancing dst past what was written); fixed by the same generator fix (A/B validated in the DF-4710 pack).
• feed_rate: structurally cannot over-return — returns count - left with left -= feed, feed ≤ min(maxfeed, left) (feeder_rate.c:1669-1688); pass-2 negative evidence soaked it live.
• bypass paths in volume/eq/matrix (return FEEDER_FEED(f->source, ...)) are bounded by the chain below them, inductively root.

With every feeder contract-abiding, rcnt = SND_FXROUND(ret, sz) ≤ count always, so mcnt = count - rcnt cannot underflow and :368's memset stays in-window. The :362 clamp in this pack's fix.diff is pure defense-in-depth against future contract violations. Likewise post-fix, feed_mixer_rec cannot wrap (this pack's fixed-generator run finds zero bad-residue buf sizes in [8194..65534] — the arming precondition does not exist).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.