DF-5116 evidence pack

Finding: dcons_crom_detach (dcons_crom.c:196) clears post_busreset with no synchronization against fw_busreset's dispatch loop (firewire.c:652-658), which runs in the fwohci interrupt handler on every physical bus reset (fwohci.c:1798). DragonFly has no DS_DETACHING state, so a mid-detach child still passes the >= DS_ATTACHED guard; a dispatch that has already loaded the non-NULL pointer proceeds to call dcons_crom_post_busreset on a softc freed by the completed detach/unload → interrupt-context UAF write (bzero(&sc->unit) + crom_add_* stores).

Status: untested — needs FireWire hardware and a won race; the audit guest has no OHCI controller (env.txt).

Contents

• VERDICT.md — full interleaving trace and family notes (sbp twin)
• trigger.sh — hardware-gated unload/reload vs bus-reset hammer
• env.txt — live guest proof of FireWire absence
• fix.diff — fw-core dispatch reference count + detach drain (firewirereg.h / firewire.c / dcons_crom.c), authored statically

Reproduce (on real hardware only)

sh trigger.sh     # + generate bus resets (cable events) during the loop

Success criterion: panic with dcons_crom_post_busreset / crom_add_* in the backtrace while dcons_crom.ko is unloaded.

DF-5116 — dcons_crom detach races unlocked post_busreset dispatch: callback on freed softc (interrupt-context UAF write)

Verdict: UNTESTED — trigger requires FireWire hardware (spontaneous bus reset racing a root kldunload); the audit guest has no OHCI controller (proved below). Mechanism is certain from the source; practical exploitation needs the race won.

Where

• sys/dev/misc/dcons/dcons_crom.c:190-207 (dcons_crom_detach, unsynchronized sc->fd.post_busreset = NULL at :196)
• sys/bus/firewire/firewire.c:652-658 (fw_busreset dispatch loop: snapshot children → if (fdc->post_busreset != NULL) fdc->post_busreset(fdc) — no lock)
• Dispatch contexts: sys/bus/firewire/fwohci.c:1798 (fwohci interrupt handler on OHCI_INT_PHY_BUS_R — any physical bus reset: cable event, PHY reset, power glitch) and sys/bus/firewire/firewire.c:412 (fw_attach initial reset).
• Consumer side of the race: sys/dev/misc/dcons/dcons_crom.c:102-122 (dcons_crom_post_busreset writes bzero(&sc->unit, ...) at :113 and crom_add_chunk/crom_add_entry/crom_add_simple_text using &sc->unit/&sc->spec/&sc->ver at :115-121).

Why the window is wide

DragonFly's device state enum has no DS_DETACHING (sys/sys/bus.h:76-82: DS_NOTPRESENT, DS_ALIVE, DS_INPROGRESS, DS_ATTACHED, DS_BUSY) — a device remains >= DS_ATTACHED for the entire duration of its detach. So fw_busreset's per-child guard (firewire.c:654) passes for a child that is mid-detach; the only protection is the NULL check of post_busreset, and that store (dcons_crom.c:196) has no common lock with the load+call (firewire.c:656-657). Nothing takes a reference on the device or softc.

Failure sequence

fwproc/ithread (fw_busreset)              kldunload thread
---------------------------------------   ------------------------------------
device_get_children(fc->bdev) snapshot
for i: state(ipsdev/fwdev) >= DS_ATTACHED
  fdc = device_get_softc(devlistp[i])
                                          dcons_crom_detach(dev)
                                            sc->fd.post_busreset = NULL
                                            ... detach completes ...
                                          (module unload, devclass unit delete:
                                           softc freed)
  fdc->post_busreset != NULL  (stale read)
  fdc->post_busreset(fdc)  -------------------> dcons_crom_post_busreset on
                                               FREED softc: bzero(&sc->unit)
                                               + crom_add_* writes  ==> UAF WRITE

The victim object is a ~100-byte device softc; the write pattern is a bzero followed by chunk/key quadlet stores — freed-slab corruption from interrupt context (crash is the realistic outcome; controlled corruption theoretical).

Trigger (needs hardware)

# loop unload/reload while the peer resets the bus (cable pull, or a second
# node sending PHY reset)
while true; do kldload dcons_crom; kldunload dcons_crom; done &
# repeatedly unplug/replug the FireWire cable

Why untested on this guest

No OHCI controller (no class 0x0c0010 device in pciconf, no /dev/fw*), so no firewire bus device exists and dcons_crom never instantiates (bus_generic_identify_sameunit only runs under an attached firewire device). dcons_crom.ko + dcons.ko load cleanly and idle — see env.txt.

Family note

sbp.c:1924 assigns sbp->fd.post_busreset = sbp_post_busreset and its detach never clears it at all — same dispatch-race class, worse; that is a separate file and out of this finding's scope.

Fix

Reference-count the dispatch (fd_cb_ref on struct firewire_dev_comm), take the reference before the NULL check in fw_busreset, and have dcons_crom_detach clear the callback and drain the refcount before returning — see fix.diff (authored statically; not buildable here).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.