DF-5347 VERDICT — REPRODUCED (kernel UAF → arbitrary-call control-flow hijack)

Root cause (path:line into sys/platform/pc64/x86_64/busdma_machdep.c)

1. _bus_dmamap_load_buffer() line 645-657: when a blocking load cannot reserve enough bounce pages, the map is queued on dmat->bounce_zone->bounce_map_waitinglist (map->buf/buflen/dmat/callback stashed in the map) and EINPROGRESS is returned. At this moment map->bpages is EMPTY and map->pagesneeded > 0.
2. bus_dmamap_destroy() line 440-449: the ONLY liveness guard is STAILQ_FIRST(&map->bpages) != NULL → EBUSY. A queued map passes the guard and is kfree(map, M_DEVBUF)d (72-byte chunk) while still linked on the waiting list. Nothing ever validates queue membership.
3. Any later bounce-page release (free_bounce_page line 1399 → get_map_waiting line 1408) pops the freed chunk: reserve_bounce_pages() line 1279 writes map->pagesreserved into freed memory; the chunk is then threaded onto the global bounce_map_callbacklist (add_map_callback line 1430).
4. busdma_swi() line 1445 runs bus_dmamap_load(map->dmat, map, map->buf, map->buflen, map->callback, map->callback_arg, 0) on the freed chunk, which ends in callback(callback_arg, segments, nsegs, error) (bus_dma_machdep line 804) — an indirect call through a function pointer read from freed, attacker-repopulatable memory.

The destroy-after-EINPROGRESS pattern is ordinary driver error cleanup (if (error) { bus_dmamap_unload(); bus_dmamap_destroy(); }). The only in-tree driver that ever receives EINPROGRESS (twa, sys/dev/raid/twa/tw_osl_freebsd.c:1390) handles it correctly; every other driver using a bouncing tag with conventional error handling would convert bounce-zone pressure into this UAF. Zone pressure is groomable by ordinary I/O on lowaddr-constrained tags (and by default hw.busdma.bounce_alignment=1 makes every tag with alignment>1 and no BUS_DMA_ALIGNED bounce).

Reproduction (all on DragonFly 6.5-DEVELOPMENT #0, clean snapshot boots)

KLD harness busdmauaf.c (plays the vulnerable driver): - private 2-page bounce zone (lowaddr=16MB), mapB loads both pages, mapA's load → EINPROGRESS (queued), - bus_dmamap_destroy(tag, mapA) → 0 — freed while linked, - heap spray reclaims the chunk ("spray chunk 0 == freed mapA" — deterministic LIFO on the 72-byte M_DEVBUF zone), - freeing mapB's pages wakes the freed map, - busdma_swi() executes the deferred load on the freed chunk and calls the planted map->callback (hijack_proof) with planted arg 0xbaadf00d:

  BUSDMA-UAF: *** HIJACK PROVEN *** attacker-chosen function
  0xffffffff82600000 executed, arg=0xbaadf00d nsegs=1 error=0

(twice on one boot; see run.log).

• POC_TEST=3 plants callback=0x414141414000 → kernel jumps there:

  Stopped at 0x414141414000: kernel: type 12 trap, code=0

(see panic.txt) — full RIP control from freed memory.

Two additional independent manifestations captured: - getmapwaiting_null_panic.txt — NULL-deref panic inside the inlined reserve_bounce_pages when the freed chunk held garbage dmat. - slab_corruption_panic.txt — the deferred load's STAILQ_INSERT_TAIL(&map->bpages, ...) wrote the bounce-page pointer at offset 0 of the still-free chunk, corrupting kern_slaballoc's free-chunk linkage; the NEXT unrelated kmalloc(72) panicked in chunk_mark_allocated (kern_slaballoc.c:1659). Reproduced twice.

Primitive / exploit chain

Arbitrary indirect call in ring 0: target = reclaimed map->callback, RDI = map->callback_arg (both fully attacker-set via the spray). With no SMEP/SMAP/KASLR on the audit guest, pointing the callback at any kernel text gadget (e.g. stack pivot → ROP, or a function that grants privileges when called with controlled RDI) is mechanically trivial — the harness demonstrates the controlled call itself, which is the hard part. Escalation to uid=0 additionally requires an unprivileged-reachable driver that destroys/unloads an EINPROGRESS map; no in-tree driver currently does, so end-to-end unpriv→root was not demonstrated and severity is High rather than Critical.

Fix validation

fix.diff (git-apply clean against the sys/ tree; applied inside the guest /usr/src only): destroy returns EBUSY while pagesneeded||pagesreserved, unload dequeues + releases the reservation (includes the one-line add_map_callback(wait_map) typo fix it depends on), busdma_swi drops unloaded maps. Patched kernel (#1 Oct 3 06:29) re-ran all three tests:

bus_dmamap_destroy(queued mapA) -> 16   (EBUSY)   [tests 1 & 3]
RESULT=FAILED (no phantom)                          [test 2]
no panic, guest stays up

Baseline behavior is GONE (dmesg_fixrun.txt).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.