DF-5308 — usb_filter_detach() error path leaves the dropped knote linked in the live USB fifo's klist → freed-knote walk + attacker-controlled f_event dispatch (use-after-free)

What

usb_filter_detach() (sys/bus/u4b/usb_dev.c:1222) is the knote f_detach callback the USB fifo layer installs from usb_kqfilter(). It begins by taking a device reference:

err = usb_ref_device(cpd, &refs, 0 /* no uref */ );
if (err) {
        return;                     /* <-- BUG: knote stays linked */
}
...
klist = &f->selinfo.ki_note;
knote_remove(klist, kn);            /* only reached on success */

usb_ref_device() fails for several routine reasons while the fifo is still alive — most simply because the FIFO refcount is saturated (f->refcount == USB_FIFO_REF_MAX, usb_dev.c:251), or the device is in USB_STATE_DETACHED (usb_dev.c:211), or the fifo slot was just delinked (usb_dev.c:251). When it fails, the knote is not removed from f->selinfo.ki_note — but the caller, knote_detach_and_drop() (sys/kern/kern_event.c:1764), destroys the knote immediately after f_detach returns. The freed knote remains linked in the fifo's klist.

The next KNOTE(&f->selinfo.ki_note, 0) — issued from usb_fifo_close() (usb_dev.c:792, gated only on f->flag_isselect, which the early-return fails to clear) or from usb_fifo_wakeup() (usb_dev.c:1784, reachable from every USB transfer completion via usb_fifo_put_data*) — walks the list with knote() (kern_event.c:1810): reads kn->kn_kq, kn->kn_status, and calls filter_event(kn, hint) → kn->kn_fop->f_event(kn, hint) — a function pointer load and indirect call through freed, attacker-reclaimable heap memory, with rdi pointing at the (attacker-forged) knote.

Trigger (fully unprivileged; user maxx, member of operator)

1. fd = open("/dev/usb/0.2.1", O_RDONLY) — ugen interrupt-IN fifo of the QEMU usb-mouse on EHCI (the same rig DF-5287/DF-5288 used).
2. Register EVFILT_READ knotes on fd from several kqueues (knote fanout).
3. Fill the per-CPU knote cache (KNOTE_CACHE_MAX = 64) so later freed knotes are kfree()d to the slab allocator and become reclaimable by any same-size kmalloc.
4. fork() 254 children that block in read(fd) — each blocked reader holds one f->refcount (usb_dev.c:1426/285), saturating it at USB_FIFO_REF_MAX (0xFF). Marker: any further ioctl on the fd fails with ENXIO (usb_ioctl → usb_ref_device, usb_dev.c:1094).
5. close() the kqueues → kqueue_terminate() → knote_detach_and_drop() → usb_filter_detach() → usb_ref_device() fails (saturated refcount) → early return; knotes freed while still linked.
6. Reclaim the freed knote slots with fully controlled 136-byte blocks: bind() AF_UNIX sockets with sa_len = 136 == sizeof(struct knote); dup_sockaddr() (kern/uipc_usrreq.c:1165 → kern ker) kmallocs sa_len bytes and copies the user buffer verbatim. DragonFly slab zones are shared per-size across malloc types, so the M_SONAME block lands on the freed M_KQUEUE knote. Forged fields: kn_next = NULL, kn_kq = 0x4343..., kn_status = 0, kn_fop = TARGET.
7. Kill the readers (refcount drains), then close(fd) → usb_cdevpriv_dtor → usb_fifo_close() → flag_isselect still set → KNOTE() → knote() walks the forged knote → filter_event().

Observed results (with-src guest kernel, usb_dev.c md5-identical to the

audited tree)

• fault rig (kn_fop = 0x4141414141414141): Fatal trap 9: general protection fault, Stopped at filter_event+0x4: testb $0x2,(%rax) — the instruction is the kn->kn_fop->f_flags & FILTEROP_MPSAFE load; %rax is our chosen non-canonical kn_fop. Reproduced 3× (panic.txt, panic.2.txt, panic.fault.txt).
• call rig (kn_fop = &kprintf - 24, so f_event == kprintf): Stopped at filter_event+0x1d: ret — the indirect f_event call through the forged kn_fop executed (the trap moved from the f_flags load to the post-call ret exactly as the forged pointer dictates) and control flow was corrupted. Reproduced 2× (panic.call.txt, panic.call.1.txt).
• the run marker shows the mechanism end-to-end: while saturated: ioctl = -1 ENXIO (refcount saturated → the same failure usb_filter_detach hits) then after drain: errno = ENOTTY (refs released, dispatch reachable again).

Primitive: arbitrary kernel function call with rdi = 136-byte attacker-controlled heap block (and an 8-byte kn_next/status-controlled walk). On this guest (no SMAP/SMEP/KASLR) this is a standard fake-filterops/ROP step away from uid=0 (point kn_fop at a controlled kernel-address structure, pivot on rdi). The chain was not completed this session; the controlled dispatch and controlled fault address are proven.

Fix

fix.diff: on the usb_ref_device() failure path, best-effort unlink the knote — re-derive the fifo pointer under usb_ref_lock (same lookup usb_ref_device() performs) and knote_remove() it if the fifo slot is still populated; if the slot is NULL the fifo (and its klist) is already gone and there is nothing to unlink. Validated by rebuild + re-run (fix_validation.md).

Files

• df5308.c — the trigger (fault/call modes)
• diag.c — refcount-saturation diagnostic
• build.sh, run.sh
• run.log, run.2.log, panic*.txt — decisive runs
• env.txt — guest environment
• fix.diff, fix_build.log, fix_validation.md

VERDICT — DF-5308 (usb_filter_detach knote use-after-free)

status: reproduced / impact: panic (controlled function-pointer dispatch through reclaimed kernel heap — memcorrupt; uid0 chain one fake-filterops step away on this no-SMAP/SMEP/KASLR guest) / confidence: certain

Root cause (line-accurate)

• sys/bus/u4b/usb_dev.c:1239-1242 — usb_filter_detach() calls usb_ref_device(cpd, &refs, 0); on failure it returns without knote_remove(), leaving the knote linked in the live fifo's f->selinfo.ki_note and leaving f->flag_isselect = 1 (usb_dev.c:1264 is the only other clear site).
• sys/kern/kern_event.c:1764-1775 — knote_detach_and_drop() calls f_detach() then knote_drop() → knote_free() → per-CPU cache or kfree(kn, M_KQUEUE) (kern_event.c:2096). The knote is destroyed even though the device-side klist still references it.
• sys/bus/u4b/usb_dev.c:791-796 — usb_fifo_close() (also reached from usb_fifo_free() at :622 and from usb_cdevpriv_dtor at :969) fires KNOTE(&f->selinfo.ki_note, 0) whenever flag_isselect is set; usb_fifo_wakeup() (:1784) fires the same from every transfer completion (usb_fifo_put_data* / usb_fifo_get_data*).
• sys/kern/kern_event.c:1810-1880 — knote() walks the list, reads kn->kn_kq, kn->kn_status, and dispatches filter_event(kn, hint) → kn->kn_fop->f_event(kn, hint) (kern_event.c:1789-1799) — an indirect call through the freed knote. Un-reclaimed stale entries are skipped because the dropped note still has KN_PROCESSING|KN_DELETING set, so the crash requires (and proves) reclamation with attacker data.
• Failure modes of usb_ref_device() reachable while the fifo is alive: refcount saturation f->refcount == USB_FIFO_REF_MAX (usb_dev.c:251 — demonstrated), USB_STATE_DETACHED (usb_dev.c:211), delinked fifo slot (usb_dev.c:251), curr_cpd mismatch (usb_dev.c:253).

How it was reproduced (unpriv maxx, /dev/usb/0.2.1, with-src kernel)

df5308.c implements: 96-kqueue knote fanout → per-CPU knote-cache fill → 254 forked readers blocking in read() to saturate f->refcount == 0xFF (proved by ioctl(unknown-cmd) = ENXIO while they sleep and ENOTTY after they are killed) → close the kqueues (all knotes dropped with the early-return) → immediate AF_UNIX bind() spray of 136-byte (== sizeof(struct knote)) sockaddrs whose bytes 2..135 are fully user-chosen (dup_sockaddr() kmallocs sa_len bytes verbatim; DragonFly slab zones are per-size, shared across malloc types) → kill the readers → close(fd) → usb_fifo_close() → KNOTE() → forged dispatch.

• fault rig (kn_fop = 0x4141414141414141): 3/3 panics Fatal trap 9 ... Stopped at filter_event+0x4: testb $0x2,(%rax) (panic.txt, panic.2.txt, panic.fault.txt) — %rax is exactly the forged kn_fop; the trap is the f_flags MPSAFE load at the address we chose. A non-USB path cannot produce this: filter_event is kqueue glue, and only the USB klist walk reaches it with our forged note.
• call rig (kn_fop = &kprintf-24 → f_event == kprintf): 2/2 traps Stopped at filter_event+0x1d: ret (panic.call.txt, panic.call.1.txt) — the trap site moved from the f_flags load to the instruction after the indirect call, exactly as the forged pointer dictates: the callee executed and control flow was corrupted at the return. (The visible-console variant of the kprintf marker was not captured; the two trap-site signatures across the two rigs are the control proof.)
• A wedged-guest manifestation (kernel hang, no panic text) also occurred twice when the walk hit junk-reclaimed slots (garbage kn_kq pool-token wait / lock deadlock) — same root cause, DoS flavor.

Exploit chain (status)

1. ✅ unprivileged dangling-knote creation (refcount saturation)
2. ✅ deterministic-ish same-slot reclamation with fully controlled 136-byte content (AF_UNIX bind spray; knote offsets kn_next@24, kn_kq@48, kn_status@88, kn_fop@120, kn_hook@128 all inside sun_path)
3. ✅ controlled indirect call kn->kn_fop->f_event(kn, 0) (rdi = forged block; controlled fault address proven; call-execution proven)
4. ⬜ uid=0: needs a known-address fake struct filterops (no KASLR: static kernel addresses known; point kn_fop at controlled memory or a static address whose +24 holds a stack-pivot gadget; ROP from rdi). Not completed this session — no hard blocker, pure exploit-dev time.

Why this is not DF-5287/DF-5288/DF-1015/DF-1016/DF-2346

• DF-1015 is a refcount leak on EOPNOTSUPP in usb_kqfilter (usb_dev.c:1191/1203) — different function, no memory corruption.
• DF-1016/DF-2346 are raw-struct proc SIGIO pointer issues — unrelated.
• DF-5287/DF-5288 live in usb_generic.c (ugen_transfer_setup, USB_FS_ ioctl races) — this finding is the usb_dev.c detach error path leaving a kqueue* object dangling; the sinks and the objects differ (knote vs usb_xfer/fs_xfer).

Fix

fix.diff (validated, see fix_validation.md): unlink the knote on the usb_ref_device() failure path via a best-effort lookup under usb_ref_lock; no-op when the fifo slot is already NULL (klist died with the fifo).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix validation - DF-5308

Baseline (unpatched with-src kernel, usb_dev.c md5 8307905e7ec38912ff7e2883279a187b

== audited tree)

Patched kernel (fix.diff: usb_filter_detach_unlink() on the error path)

Build: cd /usr/src && make -j 6 nativekernel KERNCONF=X86_64_GENERIC -> BUILD_RC=0; make installkernel -> INSTALL_RC=0; kernel #1: Fri Oct 2 13:50:14 UTC 2026.

The fix removes the knote from the fifo klist on the error path, so the KNOTE() walk at usb_fifo_close() no longer visits freed memory; the usb_ref_device() failure itself (saturation) still occurs exactly as before, isolating the fix to the dangling-link consequence.