DF-5147 — dcons_load_buffer() trusts wire-supplied buffer geometry with an overflowable sanity check (latent, dead code in-tree)

• File: sys/dev/misc/dcons/dcons.c:157-191
• Severity: Info (latent — no in-tree caller)
• Confidence: certain (code defect), reachability: none in DragonFly tree today

What the code does

dcons_load_buffer(buf, size, sc) adopts an externally-initialized dcons buffer (the header fields are network-order words in the FireWire-shared buffer, i.e. data a peer can DMA-write). It loads, with no bounds validation:

• dc->o.size / dc->i.size from buf->osize[]/isize[] (dcons.c:169-170)
• dc->o.buf / dc->i.buf = (char *)buf + ntohl(buf->ooffset[]/ioffset[]) (dcons.c:171-172) — free-form u32 displacement from buf
• dc->o.pos / dc->i.pos = wire ptr word & DCONS_POS_MASK (24-bit) (dcons.c:175-176)

The only sanity check (dcons.c:184-186):

s = DCONS_HEADER_SIZE;
for (port ...) { ...; s += dc->o.size + dc->i.size; }
if (s > size) return (-1);

fails to constrain the geometry:

1. Integer wrap: s is int, dc->o.size + dc->i.size is u32 arithmetic. osize[0]=isize[0]=0x80000000 (and likewise for port 1) makes every per-port addend 0 → s stays ~56 → passes while each channel claims a 2 GB size.
2. Offsets never checked: ooffset/ioffset can be any u32 (up to +4 GB from buf); the check sums only sizes.
3. pos never checked: pos up to 0xFFFFFF is accepted against whatever size was loaded.

Consequence if ever wired to a peer-controlled buffer

• dcons_putc() writes ch->buf[ch->pos] = c (dcons.c:118) → single-byte kernel write at peer-chosen displacement (buf + u32 offset + 24-bit pos), content = console output stream; pos auto-increments → linear scribing.
• dcons_checkc() reads ch->buf[ch->pos] (dcons.c:101) and the byte is delivered to the console/gdb reader → kernel memory disclosure to the peer (same sink as the known, live DF-2142 read bug, but reachable via baked-in geometry rather than the live wire ptr word).

Why Info / no PoC

rg over the whole sys/ tree finds no caller of dcons_load_buffer (only the prototype at dcons.h:105 and the definition). The live attach path (dcons_os.c:453/464) always uses dcons_init(), which computes all geometry from the fixed DCONS_BUF_SIZE (16 KB). The function is, however, compiled into the loadable dcons module and globally exported, and the family's threat model (FireWire peers DMA-writing the published buffer — DF-2142, DF-5116..5118) makes it a live trap if any future change re-wires it.

Per the audit contract, Low/Info hardening findings are not PoC-verified; this pack records the defect and the hardening fix only.

Reproduce (analysis-level)

Read-only; the decisive references are: - sys/dev/misc/dcons/dcons.c:169-186 (unvalidated loads + wraparound-able check) - sys/dev/misc/dcons/dcons.c:101 / :118 (read/write sinks at ch->buf[ch->pos]) - caller search: rg -n 'dcons_load_buffer' sys/ → only dcons.c:158 and dcons.h:105

Fix

Apply fix.diff in this directory (bounds + 64-bit accumulation + pos<size).

VERDICT — DF-5147

Status: untested (Info-severity hardening finding — PoC skipped per audit contract; no Critical/High actionability, no in-tree reachability).

Narrative

Pass-2 deep audit of sys/dev/misc/dcons/dcons.c (beyond known DF-2142 wire-pos OOB read and the DF-4781/4782 dcons_os siblings) established:

1. The live write path cannot be poisoned by a FireWire peer. dc->o.{size,pos,buf} are set only by dcons_init_port() (dcons.c:138-141) from kernel-computed values derived from the fixed DCONS_BUF_SIZE = 16 KB (dcons_os.c:75-77); optr[] is written only by the kernel via DCONS_MAKE_PTR (dcons.c:124); the wire-controlled resync branches (dcons.c:67-68, 96-98) touch only dc->i. Hence the output ring cursor is confined to [0, o.size) and dcons_putc's store at ch->buf[ch->pos] (dcons.c:118) is always in-bounds on every live path. The known DF-2142 covers the input-side OOB read.

2. dcons_load_buffer() (dcons.c:157-191) is a certain latent memory-safety defect. It adopts wire-format geometry (sizes, offsets, generation and 24-bit positions) from the shared buffer header into the softc with a single "sanity check" that (a) never bounds ooffset/ioffset against size (dcons.c:171-172), (b) never checks pos < size (dcons.c:175-176), and (c) accumulates s += dc->o.size + dc->i.size (dcons.c:181) as int over u32 addends that wrap — e.g. osize=isize=0x80000000 for both ports yields addend 0 and the check passes with 2 GB channel sizes. If any code ever calls it on a peer-writable buffer, dcons_putc (dcons.c:118) becomes a byte-wise kernel write at peer-chosen displacement (buf + u32 offset + 24-bit pos) and dcons_checkc (dcons.c:101) a peer-steered kernel read whose result is delivered to the console/gdb reader.

3. Reachability today: none. rg -n 'dcons_load_buffer' sys/ finds only the definition (dcons.c:158) and the prototype (dcons.h:105). The DragonFly attach path always calls dcons_init() (dcons_os.c:453, 464). The function is still compiled into the dcons module and exported, one re-wiring away from the primitive above.

Because the defect is real at the code level but unreachable in this tree, it is filed as Info (hardening / latent OOB), confidence certain about the defect itself, and no guest PoC was run (nothing observable — dead code). fix.diff hardens the loader: 64-bit accumulation, offset+size bounds, and pos < size per channel.

Classes considered and killed (full-file sweep)

• OOB write via wire on dc->o: impossible live (see 1).
• dcons_ischar (dcons.c:47-73): dead code (no callers), identical resync defect to DF-2142 — already recorded in DF-2142's summary; not re-reported.
• Unlocked concurrent dcons_putc (console vs tty drain): unsynchronized ch->pos++ can drop/duplicate console bytes; both racers store N+1 (never N+2), aligned u32 *ch->ptr store is atomic → console-stream corruption only, no memory-safety consequence.
• dcons_init/dcons_init_port arithmetic (dcons.c:136, 199-204): fixed 16 KB input, port regions exactly tile [DCONS_HEADER_SIZE, size), no overflow.
• Info leak via shared header: kernel stores only offsets/sizes/ptr-words in struct dcons_buf; no kernel pointers published from dcons.c (paddr publication is dcons_crom.c, tracked as DF-5116..5118).
• dcons_checkc wrap logic (dcons.c:102-106): pos++ then >= size wrap — no off-by-one; buf[size] never touched on kernel-maintained cursors.

Fix validation

not_testable — latent dead-code defect; the fix is hardening validated by inspection. No baseline misbehavior exists to reproduce and no guest run was performed for this finding (guest untouched).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.