snd_hdspe attach has no error unwind: failed attach leaks snd lock/IRQ/DMA resources and leaves hdspe_intr live on a dead device — after kldunload the IRQ vector dispatches into unmapped module text
Summary
Every error return after bus_setup_intr exits without releasing anything and newbus never detaches a failed attach: resources leak AND the vector stays armed on a dead device - kldunload leaves it over unmapped text (wild ring-0 jump on next IRQ). Boot-conditioned + root-unlock-gated. Mirror-the-detach unwind fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4963 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
attach fails after bus_setup_intr -> no unwind -> kldunload snd_hdspe -> module text unmapped, vector armed -> IRQ fires -> jump to freed text
Evidence (decisive lines)
findings/poc/DF-4963/ (this verdict; code-trace proof)
Verdict
Hardware-gated (no RME 10ee:3fc6 on guest): hdspe_attach creates the lock, enables busmaster, maps BAR0, registers hdspe_intr and allocates DMA - then every error return (rev default, alloc_resources inner failures, init failure, bus_generic_attach failure) exits without releasing anything, and DFly newbus never detaches a failed attach: the IRQ cookie/rman/dmat/pbufs/lock all leak AND the ICU keeps dispatching hdspe_intr on a dead device - kldunload snd_hdspe then leaves the vector armed over unmapped module text (next audio IRQ = wild ring-0 jump). Boot-conditioned + root-unlock-gated. Mirror-the-detach unwind fix.
No comments yet.