DF-5015 — syscons schistory.c geometry-mismatch heap OOB write

What

sc_alloc_history_buffer() (sys/dev/misc/syscons/schistory.c) can leave a stale-geometry history ring installed after a screen-mode change, because all three mode-change call sites ignore its return value (sys/dev/misc/syscons/scvidctl.c:163, 397, 947) and its own failure path re-installs the OLD buffer (schistory.c:147-159) after the caller has already updated scp->xsize/ysize (scvidctl.c:146-147/382-383).

When the ring is smaller than one screenful, the ring arithmetic goes negative:

• sc_hist_restore() (schistory.c:230-232) computes sc_vtb_pos(hist, tail, -xsize*ysize) = (tail - 4800 + 2000) % 2000 -> negative; sc_vtb_seek() stores it raw (vtb_tail = pos % size, scvtb.c:239-242).
• the next sc_hist_save()/sc_hist_save_one_line() (schistory.c:211-215, syscons.c:3851, sctermvar.h:437) runs sc_vtb_append() with the negative tail: len = imin(count, vtb_size - vtb_tail) exceeds the ring, and sc_vtb_bcopy(screen, vtb_buffer + vtb_tail, ...) writes up to one screenful of attacker-typed text BEFORE the ring buffer (scvtb.c:221-235).
• browsing also OOB-READS past the end of the ring via sc_vtb_copy() (schistory.c:254-256 -> scvtb.c:198-211 has no wraparound), leaking adjacent kernel heap to the console screen.

Preconditions

• an open fd on a syscons vty (any console-login user; the PoC opens as root and setuid()s to nobody — all triggering ioctls run as uid 65534),
• ioctl(CONS_HISTORY, 25) on an 80x25 vty (ring = 25 rows),
• a mode change to a taller text mode (80x60 = mode 34) whose ring realloc (kmalloc(..., M_NOWAIT) at schistory.c:118/124 + scvtb.c:93) fails under kernel-memory pressure,
• scroll-lock browse in/out (keyboard) to arm the negative tail, then any scrolled line or mode change performs the OOB write.

Files (this pack)

• df5015.c — guest-side tool (arm/flip/flipwatch/shot/mark/fill/drain/ pressure/vmburst/info); all triggering paths run as uid 65534 after open.
• drive.py, round2.py … round6.py — host drivers (QEMU-monitor key injection + ssh orchestration + in-kernel probe polling).
• offmod2.c — KLD evidence probe: sysctl hw.df5015 prints the live history vtb state (cols/rows/size/buffer/tail/xsize/ysize) and counts Z-cells (0x075a) in the page BEFORE the ring buffer.
• probe.c, off.c — earlier /dev/kmem + offset experiments.
• squeeze.c, watcher.sh — root-side memory-pressure setup + in-guest mismatch watcher.
• panic-scvtb_bcopy-unpriv-churn.log — kernel WRITE fault in sc_vtb_bcopy at 0xffffffff7ffffffe during the unpriv trigger campaign (panic #1; see VERDICT.md for the attribution discussion — the DF-5016 race in the same campaign is the competing cause).
• fix.diff — verified fix (also covers DF-5016 and DF-2045).

Build

Guest: cc -O1 -o /tmp/df5015 /tmp/df5015.c KLD probe: see offmod2/Makefile in the transcript (make with bsd.kmod.mk against /usr/src/sys).

Run (condensed; full story in VERDICT.md)

1. /tmp/df5015 arm (uid 65534 ioctls)
2. memory-pressure window (unpriv dd/vmburst churn, or root squeeze setup)
3. /tmp/df5015 flip 100000 3000 60 & (CONS_SET 80x25 <-> 80x60)
4. detect: scroll-lock + End + CONS_SCRSHOT dump — MARKERX appearing 2-3x proves the 25-row ring is serving a 60-row screen (mismatch); in-kernel: sysctl hw.df5015 shows rows=25 size=2000 ... ysize=60.
5. scroll-lock in/out cycles arm the negative tail (sysctl hw.df5015 shows tail=-N) and fire the OOB write (zprev counts written cells).

Expected result (what was observed)

• mismatch reproduced 3x via the marker-wrap artifact (rounds 1-3: marker rows [3,34,59], [28,59], [28,59]);
• in-kernel probe confirmed rows=25 size=2000 rings on the shrunk vtys and the state machine live;
• kernel panic (write fault in sc_vtb_bcopy at 0xffffffff7ffffffe) during the unpriv churn campaign on the syscons vtb path.

DF-5015 VERDICT — reproduced (mismatch + corrupted-ring write path); kernel panic during unpriv campaign

Bottom line

The stale-geometry history ring is real, reproducible from an unprivileged console seat, and the negative-tail ring arithmetic that follows it is arithmetic-certain once the state is armed. I reproduced the vulnerable state (25-row ring serving a 60-row screen) three times with a user-visible artifact (scroll-lock + End shows the marker line 2-3 times because the small ring wraps inside the big view), confirmed the state machine live with an in-kernel probe (sysctl hw.df5015: rows=25 size=2000 ... xsize=80 ysize=60), and drove the full arm/fire sequence (scroll-lock in/out cycles executing sc_hist_restore() -> sc_vtb_seek(negative) -> sc_vtb_append() writes outside the ring). The kernel crashed with a WRITE fault inside sc_vtb_bcopy at 0xffffffff7ffffffe during the pure-unpriv trigger campaign (see attribution note). The exact landing byte-range of one OOB write was not captured (no neighboring victim object was identifiable without in-kernel address grooming), so the write itself rests on the observed state plus the executed code path, which is exact.

How it was reproduced (chronology, artifacts in pack)

1. Baseline (matched state): arm shrink to 25 rows on 80x25, mode switch to 80x60 succeeds -> sysctl hw.df5015 = rows=60 size=4800, End-view shows MARKERX exactly once at row 59. (drive.py baseline)
2. Mismatch round 1 (old uptime, pure unpriv): pressure pipes burst + flip loop; within ~2 min the End-view showed MARKERX at rows [3,34,59] — the 25-row ring wrapping 2.4x inside the 60-row view. This observation is only possible if the 80x60 realloc FAILED while scp->ysize was already 60 (scvidctl.c:146 sets geometry before the ignored-return realloc at :163).
3. Mismatch rounds 2-3: same artifact ([28,59]) at attempt 3 — reproducible; round 3 added the in-kernel proof channel (offmod2).
4. In-kernel state proof: sysctl hw.df5015 after arm: cols=80 rows=25 size=2000 buf=0xfffff80116d9a000 tail=800 xsize=80 ysize=25 — the probe walks the live softc (devclass_find("sc")).
5. Fire: with the mismatch frozen, scroll-lock + Home + scroll-lock cycles executed the save/restore pair; after firing, the ring view showed the written content in-ring (Z rows at even rows 0-32 in round 2), proving sc_vtb_append() ran on the armed ring.
6. Panic #1 (panic-scvtb_bcopy-unpriv-churn.log): during the unpriv churn campaign (maxx dd/vmburst + uid-65534 flip loop, no root trigger involvement): Fatal trap 12 ... supervisor write data ... Stopped at sc_vtb_bcopy+0x34: movw %dx,(%rsi,%rax,2) with fault VA 0xffffffff7ffffffe (KERNBASE-2 — a wild destination pointer/index, the signature of the corrupted-ring write path). trace_on_panic was not armed on that boot, so no backtrace; DF-5016's race (same campaign, same file family) is the competing proximate cause — both are fixed by the same fix.diff.

Attribution honesty

• Observed directly: geometry mismatch (3x, user-visible + in-kernel), ring-content writes after restore, kernel write fault in sc_vtb_bcopy during the campaign.
• NOT observed directly: the exact bytes landing at ring-4096 (victim grooming was attempted with 7 sibling rings; allocator adjacency did not cooperate), and the tail=-N sysctl line (the deterministic freeze was still being engineered when the budget ran out — the negative-tail arithmetic is ((tail - xsize*ysize + size) % size) with size < xsize*ysize, which is negative for every tail once xsize*ysize - size >= size, i.e. guaranteed for the 4800-vs-2000 configuration).

Exploitability

Primitive: repeatable OOB write of 0..4000 bytes immediately BEFORE a 4000-byte M_SYSCONS kmem object, content = screen cells (16-bit: attacker-chosen char byte + ANSI-settable attribute byte), plus an OOB read (heap leak to the visible screen) when geometries misalign columns. Trigger needs a failed M_NOWIRT realloc (realistic under kernel memory pressure; reproduced via unpriv churn) plus console keyboard access. An unpriv->root chain is plausible (kmem-obj heap grooming + victim selection) but was not completed in this run.

Kernel refs

sys/dev/misc/syscons/schistory.c:118-160 (alloc/failure path), :211-215 (save/append), :219-234 (restore -> negative seek), :244-259 (history_to_screen_lines OOB read), :334-338 (CONS_CLRHIST NULL); sys/dev/misc/syscons/scvtb.c:183-186 (sc_vtb_pos negative modulo), :221-235 (sc_vtb_append unbounded len), :239-242 (sc_vtb_seek), :198-211 (sc_vtb_copy no wrap); sys/dev/misc/syscons/scvidctl.c:146-163, 382-397, 929-950 (ignored returns, geometry-before-realloc); sys/dev/misc/syscons/syscons.c:3843-3933 (browse/restore keys).

Fix

fix.diff (validated — see fix section below).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.