DF-5022 VERDICT — feed_volume_init() double free

Status: REPRODUCED (panic) · confidence certain · impact panic (kernel memory-corruption class; stock kernel detects the second free and panics — kernels without slab double-free detection get a duplicated freelist entry instead, i.e. aliased live objects).

How it was reproduced

Guest: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC, no sound(4) compiled in — sysctl hw.snd unknown).

Because the stock kernel cannot instantiate the feeder machinery, the PoC builds a KLD (df5023_dblfree.ko) that:

1. compiles the real, unmodified sys/dev/sound/pcm/feeder_volume.c (Makefile .PATH: /usr/src/sys/dev/sound/pcm — the feeder_volume.o linked into the module is byte-compiled from the audit target itself);
2. contains a verbatim copy of feeder.c's feeder_create() / feeder_destroy() — the exact code chn_addfeeder() (feeder.c:236-251) executes. Only substitutions: M_FEEDER (a static MALLOC_DEFINE inside feeder.c, unreferenceable) → module-local M_DF5023; feeder_register() bookkeeping stubbed to capture the FEEDER_DECLARE (feeder_volume.c:306) class pointer at kldload; sndstat_register/unregisterfile stubs; and feeder_matrix_default_channel_map() + its two static tables copied verbatim from feeder_matrix.c:84-101,573-582 (compiling all of feeder_matrix.c would collide on the FEEDER_DECLARE SYSINIT symbol name).
3. runs a control first (valid S16_LE/2ch → init OK, clean destroy, distinct probe allocations), then the trigger: desc.in = AFMT_S16_LE (channel field == 0).

Decisive evidence

panic.txt / run.log (serial console of the baseline run):

df5023: control OK: feeder_volume init'd on 0x00200010 (f->data=0xfffff8004f164338), destroying cleanly
df5023: control allocs: 0xfffff8004f164338 != 0xfffff8004f164370 (expected distinct)
df5023: TRIGGER: desc.in=0x00000010 AFMT_CHANNEL=0
feeder_init(0xfffff8008d9fc750) on feeder_volume returned 22
panic: memory chunk 0xfffff8004f164370 is already free!
chunk_mark_free() at chunk_mark_free+0xae
_kfree() at _kfree+0x262
feed_volume_free() at feed_volume_free+0x21      ← feeder_volume.c:190 kfree(f->data)
feeder_create() at feeder_create+0xf8            ← verbatim feeder.c:213 feeder_destroy()
df5023_modevent() at df5023_modevent+0x1f1

The control proves the harness is faithful (valid path inits and destroys cleanly, allocations behave). The trigger proves the second free: the chunk (0xfffff8004f164370 — the second control allocation, i.e. the same 64-byte slab zone info lives in) is already on the freelist when feed_volume_free() frees the dangling f->data.

Root cause (path:line)

• sys/dev/sound/pcm/feeder_volume.c:165 — f->data = info; before validation completes
• sys/dev/sound/pcm/feeder_volume.c:167-170 — m == NULL → kfree(info), return EINVAL, f->data dangling
• sys/dev/sound/pcm/feeder_volume.c:173-175 — apply_matrix failure → same shape (unreachable today: the default map for channels 1..8 always passes apply_matrix's own validation)
• sys/dev/sound/pcm/feeder.c:210-216 — init failure → feeder_destroy(f)
• sys/dev/sound/pcm/feeder.c:178-182 — FEEDER_FREE(f) → feed_volume_free() → second kfree
• sys/dev/sound/pcm/feeder_matrix.c:577-579 — default_channel_map(0) returns NULL (0 < 1)

Reachability honesty (why severity Low, not High)

The 0-channel precondition cannot be produced by an unprivileged user through in-tree paths today: every format reaching the volume feeder is SND_FORMAT(..., m->channels >= 1, ...) built through feeder_matrix_format_map() which has no 0-channel entry (feeder_chain.c:654-667, channel.c:668). The defect detonates if a driver-supplied matrix (CHANNEL_GETMATRIX / chn_setmatrix) or a future chain-builder regression ever presents a 0-channel format to feeder_volume. FreeBSD head (checked 2026-09) carries the identical code shape — defect is upstream-inherited, unfixed there too.

So: reproduced=1, impact=panic, but the finding is filed Low because no unprivileged trigger exists in-tree; this is a live memory-corruption landmine one validation regression away, not an escalation path today.

Exploit chain

None developed — precondition is kernel-internal (0-channel feeder format); on this guest the stock slab allocator detects the double free and panics (deterministic DoS). On builds without the check, the duplicated freelist entry aliases two live kernel objects of the 64-byte class — an exploitation primitive (cross-object type confusion) if a trigger is ever added.

Fix validation

fix.diff: NULL out f->data before both kfree(info) in feed_volume_init() (feeder_volume.c:167-170, 173-175).

• baseline: panic (above).
• patched (patch -p1 -d /usr/src < fix.diff, module rebuilt from the patched tree — same source file, same cc 8.3 flags as the kernel would use; a full kernel rebuild is impossible on this guest because X86_64_GENERIC has no sound(4)): kldload rc=0, control OK, trigger still returns EINVAL ("feeder_init returned 22") without any panic, guest healthy (fix_run.log). fix_status=fixed (module-level validation, documented).

Guest left clean: module unloaded, /usr/src restored from backup, final vm.sh reset with-src.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.