DF-5043 — VERDICT

Verdict: REPRODUCED (runtime replay of verbatim driver code; HW-gated natural trigger) Class: resource leak (CWE-772) Impact ceiling: none (pinned IRQ resource per failed attach) Confidence: certain

Reproduction

Same harness as DF-5042 (see ../DF-5042/VERDICT.md for the technique). Mode 2 (kenv df5042.irqfail=1): the verbatim adv_pci_attach() reaches the interrupt stage; fk_bus_alloc_resource hands out a fake IRQ resource and records it; fk_bus_setup_intr returns failure; the adv_pci.c:289-294 unwind calls adv_free() and bus_release_resource(dev, SYS_RES_IOPORT, ...) only. Observed in run.log:

FK: bus_alloc_resource(IRQ) -> fake irq resource 0xffffffff82606820
FK: bus_setup_intr -> scripted FAILURE
FK: bus_release_resource(IOPORT)
DF5042: bus_release_resource: IOPORT=1 IRQ=0; bus_setup_intr calls=1
DF5042: *** IRQ resource NEVER RELEASED on the bus_setup_intr failure unwind -- DF-5043 LEAK PROVEN ***

Mechanism (source-confirmed)

adv_pci.c:287-294:

irqres = bus_alloc_resource(dev, SYS_RES_IRQ, &irqrid, 0, ~0, 1,
                RF_SHAREABLE | RF_ACTIVE);
if (irqres == NULL ||
    bus_setup_intr(dev, irqres, 0, adv_intr, adv, &ih, NULL)) {
    adv_free(adv);
    bus_release_resource(dev, SYS_RES_IOPORT, rid, iores);   /* only IOPORT */
    return ENXIO;
}

When bus_alloc_resource succeeded but bus_setup_intr failed, irqres is never released (SYS_RES_IRQ, rid 0, RF_ACTIVE). Because the attach fails, newbus (device_doattach, sys/kern/subr_bus.c:2115-2124) unbinds the driver without invoking any detach method — nothing ever releases the resource. The device is left in DS_NOTPRESENT with an active rman IRQ reservation against it; re-probes of the device continue to work only because rman re-grants the same owner, but the reservation (and its interrupt vector bookkeeping for MSI systems) persists. This is the adv twin of DF-4969 (adw_pci error unwinds).

Fix validation (runtime A/B)

The IRQ-release hunk of fix.diff (identical file as DF-5042's pack; the diff covers both unwind defects) adds:

if (irqres != NULL)
    bus_release_resource(dev, SYS_RES_IRQ, irqrid, irqres);

Patched replay (run.2.log): bus_release_resource: IOPORT=1 IRQ=1, "unwind clean (fix effective?)". Baseline vs patched on the same guest, same scripted chip, same verbatim driver code.

Gating precondition

AdvanSys 0x10CD PCI HBA whose attach passes DMA/chip init but fails bus_setup_intr (IRQ exhaustion, msix setup failure), or a VFIO endpoint engineered to do so. Availability hygiene only; no escalation path.

Exploit chain

Not applicable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.