DF-5295 — rum_tx_mgt() permanently orphans a tx_data slot on its

early-error paths (TX path exhaustion)

What

sys/bus/u4b/wlan/if_rum.c:1478-1494
    data = STAILQ_FIRST(&sc->tx_free);
    STAILQ_REMOVE_HEAD(&sc->tx_free, next);
    sc->tx_nfree--;                     <-- slot popped FIRST

    wh = mtod(m0, struct ieee80211_frame *);
    ...
    if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
        k = ieee80211_crypto_get_txkey(ni, m0);
        if (k == NULL)
            return (ENOENT);    <-- slot orphaned forever
        if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) &&
            !k->wk_cipher->ic_encap(k, m0))
            return (ENOBUFS);   <-- slot orphaned forever

The entry is off tx_free, never goes to tx_q, holds no mbuf; nothing ever increments tx_nfree for it again. RUM_TX_LIST_COUNT is 8 and RUM_TX_MINFREE is 2 (if_rumvar.h:29-30), so:

• rum_start() (:1734) gates on tx_nfree >= RUM_TX_MINFREE — after 7 orphaned slots the interface stops dequeuing frames entirely;
• rum_raw_xmit() (:3055) gates the raw path the same way;
• only rum_init() → rum_setup_tx_list() (:2577/:787-804) restores the list, i.e. recovery needs ifconfig down/up.

Sibling comparison: rum_tx_data() performs the same key checks at :1631-1645 BEFORE its pop (:1670) and m_freem()s on error — the pop-before-validate ordering is unique to rum_tx_mgt.

Trigger: raw 802.11 management frame with the Protected flag set and no matching key (or a failing SWCRYPT encap) through the legacy rum_raw_xmit() path (params == NULL, :3060-3065) — i.e. bpf raw injection on the wlan interface (privileged: /dev/bpf is root-only). The caller (ieee80211_raw_output, ieee80211_output.c:631-639) frees the mbuf and the node on error — only the slot leaks.

Hardware gating

Deterministic driver-logic bug; rum(4) needs absent RT2573 hardware. rum_txslot_leak.c is an exact state-machine model of the pop/error/gate logic. Guest output (run.log): wedge after exactly 7 injections; only down/up resets.

Build / Run / Expected

cc -O2 -Wall -o rum_txslot_leak rum_txslot_leak.c && ./rum_txslot_leak

Expected: TX path wedged after 7 injections ...; after ifconfig down/up: tx_nfree=8.

Fix

fix.diff — move the pop after the validation block (mirror of rum_tx_data). git apply --check clean. Kernel fix validation hardware-gated (fix_status: not_testable).

DF-5295 VERDICT — deterministic tx_free slot leak in rum_tx_mgt

Status: inconclusive (hardware-gated). Bug: real, deterministic.

Why the bug is certain from source alone

rum_tx_mgt pops the tx_free head and decrements tx_nfree (if_rum.c:1478-1480) before validating the frame; the two error returns at :1490 (ENOENT: Protected mgmt frame, ieee80211_crypto_get_txkey → NULL) and :1494 (ENOBUFS: SWCRYPT ic_encap failure) abandon the popped entry with no list insertion and no compensating tx_nfree++. With RUM_TX_LIST_COUNT=8 / RUM_TX_MINFREE=2 (if_rumvar.h:29-30), seven such errors wedge the TX path (rum_start:1734 gate) until rum_init→rum_setup_tx_list (:2577) runs (down/up). The mbuf and node are correctly freed by the caller (ieee80211_raw_output, net80211/wlan/ieee80211_output.c:631-639) — the leak is the slot alone.

Reachability: rum_tx_mgt is called only from rum_raw_xmit (:3065, params==NULL legacy path) ← ic_raw_xmit ← ieee80211_raw_output ← bpf writes on the 802.11 interface. /dev/bpf is root-only on DragonFly ⇒ privileged trigger ⇒ Low severity (local DoS of the interface, recoverable by an admin down/up).

Why inconclusive on this guest

No RT2573 hardware ⇒ rum_raw_xmit cannot be entered. The logic is modeled exactly (rum_txslot_leak.c); guest output confirms the wedge arithmetic (7 injections → tx_nfree=1 → gate fails; down/up restores 8).

Fix

Move the pop to after the validation block (mirroring rum_tx_data's ordering), fix.diff, git apply --check clean. Hardware-gated: not_testable for kernel validation.

Kernel references

• sys/bus/u4b/wlan/if_rum.c:1478-1480 (pop before validation)
• sys/bus/u4b/wlan/if_rum.c:1487-1494 (orphaning returns)
• sys/bus/u4b/wlan/if_rum.c:1631-1645 (rum_tx_data does it right)
• sys/bus/u4b/wlan/if_rum.c:1734 (rum_start MINFREE gate)
• sys/bus/u4b/wlan/if_rum.c:2577, 787-804 (only recovery path)
• sys/bus/u4b/wlan/if_rumvar.h:29-30 (LIST_COUNT=8, MINFREE=2)
• sys/netproto/802_11/wlan/ieee80211_output.c:631-639 (caller frees m/ni)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.