DF-5361 -- CISTPL_END MFC reset frees the pf structs but leaks every cfe on their chains (per-insertion kernel heap leak; unbounded with DF-5362)

File: sys/bus/pccard/pccard_cis.c (verify pass, GLM 5.3). Full narrative: VERDICT.md.

Reproduce (verbatim production parser, guest toolchain, no PCMCIA HW needed)

./build.sh          # sh extract.sh .  &&  cc -O2 -Wall -o rig rig_main.c
./run.sh            # baseline scenarios: ./rig mfcleak && ./rig benign
sh run_matrix.sh    # A/B: baseline vs each single-fix variant, all scenarios

Expected decisive output (DF-5361): BASELINE: mfcleak card (CONFIG+CFTABLE+CFTABLE+MFC+NO_LINK+END, then a clean MFC chain) parses to normal termination with LEDGER 'alloc cfe=2 pf=1 | kfree cfe=0 pf=1 | LIVE cfe=2' -- 2 x 160-byte pccard_config_entry blocks orphaned by the reset at :638-644. The benign VALID 2-function MFC card also leaks its single pre-MFC cfe (LIVE cfe=3 of which 1 orphaned) -- the leak fires on well-formed cards, not only crafted ones. WITH fix.diff (f5361): LIVE cfe=0 and benign LIVE cfe=2 (only the entries belonging to the two live functions, freed by the correct teardown); everything else unchanged.

What it proves

The rig executes the byte-identical production parser extracted from the guest's /usr/src (sha256-gated; extract_manifest.txt) through the real entry pccard_read_cis(). Kernel entry is hardware-gated (no PCMCIA bridge in QEMU) -- see VERDICT.md for the method, the A/B matrix, and the booted-combined-fix-kernel validation.

Recommended fix: Drain pf->cfe_head (STAILQ_REMOVE_HEAD + kfree) before kfree(pf) in the MFC reset, mirroring pccard_detach_card pccard.c:317-324. (fix.diff; validated, see fixed_run.log / matrix.log / postboot_run.log).

Note: poc_pccard_cis2.c is the seeded hand-written model from the earlier model-only verdict (status was untested); it is kept for history and is SUPERSEDED by the verbatim rig (extract.sh + rig_main.c + rig_shims.h) which reproduces its numbers on the byte-identical production parser.

DF-5361 -- VERDICT

Verdict in one line

REPRODUCED (verbatim-rig level; deterministic) -- impact: leak. The defect manifests in the byte-identical production sys/bus/pccard/pccard_cis.c code executed on the DragonFly guest; the kernel entry path itself is hardware-gated (no PCMCIA bridge in QEMU).

REPRODUCED at the verbatim-rig level on the DragonFly guest; kernel entry hardware-gated (no PCMCIA bridge). The verbatim CISTPL_END MFC reset (pccard_cis.c:635-649) kfrees the pccard_function structs (:641) and reinits pf_head (:644) but never drains pf->cfe_head, orphaning every pccard_config_entry the CFTABLE handler kmalloc'd and STAILQ_INSERT_TAIL'd (:908-917). The rig's instrumented ledger on the verbatim parser: a terminating CONFIG+CFTABLE+CFTABLE+MFC+END card returns normally with alloc cfe=2, kfree cfe=0, LIVE cfe=2 (2 x 160 B = 320 B leaked per insertion), exactly upgrading the seeded model's numbers to the production code. The benign scenario proves the real-world case: a fully VALID two-function MFC card leaks its pre-MFC cfe on every insertion (pccard.c:195 attach path; pccard_detach_card :317-324 can only free what is still linked). Combined with the DF-5362 chain cycle the leakloop scenario shows unbounded growth (+1 cfe per 22 bus reads; 4545 LIVE cfes at read-budget 100k, 9090 at 200k -- exactly linear, and the kernel has no budget). Fix validated: single-fix rig A/B (LIVE cfe=0; benign keeps exactly its two functions' entries) and the combined-five-fix kernel built -Werror, booted, and the rig re-driven from the running kernel's patched source: alloc cfe=2 kfree cfe=2 LIVE cfe=0.

Method -- the verbatim rig (why this is production code, not a model)

The guest has no PCMCIA/CardBus bridge (env.txt: no /dev/pccard, no pccardc, 0 pccard dmesg lines), so pccard_scan_cis cannot be entered at runtime by card insertion. Instead of hand-replicating the parser, the rig machine- extracts the production parser byte-identical from the guest's own kernel source* and executes it:

• extract.sh sed-extracts, from /usr/src/sys/bus/pccard/pccard_cis.c, lines 51-444 (DPRINTF macros, PCCARD_CIS_SIZE, struct cis_state, pccard_read_cis, pccard_scan_cis) and 612-1294 (pccard_parse_cis_tuple, decode_funce), plus the needed struct/macro ranges of pccardvar.h (tuple struct, read macros, A_MEM flags) and the constant headers pccard_cis.h/pccardreg.h whole.
• The extraction is sha256-gated: all four pccard files plus sys/sys/queue.h must match the audited pristine tree (acdd2484... for pccard_cis.c); extract_manifest.txt in this pack is the guest-generated record. The userland <sys/queue.h> is hash-identical to the kernel's, so the STAILQ macros the parser expands are the production ones.
• rig_shims.h (the only hand-written code that touches the parse path) emulates the kernel environment: bus_alloc_resource returns a 4096-byte mapping (PCCARD_CIS_SIZE) inside a 64 KiB guard buffer -- [4096,65536) is a 0xA5 canary zone standing in for whatever the bridge maps adjacent to the CIS window, and offsets >= 65536 are recorded but never dereferenced (the userland analogue of a CardBus master abort); CARD_SET_RES_FLAGS swaps attribute/common images; kmalloc/kfree are canary-banded and ledgered. Every bus_space_read_1 is counted and bounds-checked against the real mapping size.
• rig_main.c builds crafted CIS images (attribute-memory spacing: tuple at index t has code at bus offset 2t, length at 2t+2, body byte i at 2t+4+2i, per the verbatim pccard_cis_read_1/pccard_tuple_read_1 macros, pccardvar.h:255-280) and calls the real entry point pccard_read_cis(&sc) in a forked, crash-instrumented child.

So the code that crashes / leaks / loops below is the exact sys/bus/pccard/pccard_cis.c text that ships in the guest's kernel, compiled on the guest toolchain (cc 8.3).

A/B discipline

run_matrix.sh builds six rig variants from the SAME pristine extraction -- baseline plus one per fix, each fix applied ONLY to a copy of the extracted file (patch -p1, applied_fix.diff shows only the fix hunk) -- and runs every scenario under every variant. Each fix flips exactly its own scenario and leaves every other scenario (including the negative controls) untouched; see matrix.log and the summary table in this file.

matrix.log summary (baseline + each single-fix variant)

Kernel-level fix validation (combined five-fix kernel)

1. All five fix.diffs patch -p1-applied to the guest's /usr/src (kernel_apply.log; patched pccard_cis.c sha256 67334ef6...).
2. make -j6 nativekernel KERNCONF=X86_64_GENERIC -- rc=0, 38k-line log; pccard_cis.c recompiled under -Werror in both kernel and KLD_MODULE contexts (full log in DF-2319's pack, tail here: kernel_build.tail.log).
3. make installkernel -- rc=0; rebooted into 6.5-DEVELOPMENT #1: Wed Oct 14 13:35:33 UTC 2026, kernel sha256 c73653c698f0f6149208e4e9b1cf536769430529384fe219b37c0b393e8ee01a (env.txt).
4. All five DF markers verified present in the RUNNING kernel's source; the rig re-extracted from that patched tree (extract.sh reports SOURCE_STATE=PATCHED, postboot_extract_manifest.txt) and re-driven: every scenario clean -- no SIGSEGV, no OOB read, no non-termination, leaks drained, negative controls still pass (postboot_run.log).
5. Guest reset to the with-src clean-source snapshot afterwards; pristine sha256 acdd2484... re-verified (guest left up and clean).

Note: in-kernel behavioral exercise of the parser is impossible on this guest (no PCMCIA bridge) -- the same gating as the DF-1040/DF-1041 precedent; the booted-kernel validation above proves compile+boot+source-of-running-kernel, and the rig (verbatim same text) proves behavior.

Ledger evidence

mfcleak (crafted, terminating): alloc cfe=2 pf=1 | kfree cfe=0 pf=1 | LIVE cfe=2 -- the reset at :638-644 freed the pf but orphaned both 160-byte config entries.

benign (fully VALID 2-function MFC card): LIVE cfe=3 of which 1 is the orphaned pre-MFC entry (harness teardown drains only 2 with the pf chain) -- the leak fires on well-formed cards, on every insert/eject (pccard.c:195), because pccard_detach_card (:317-324) can only free what is still linked.

Amplifier: see DF-5362's leakloop -- LIVE cfe grows +1 per 22 bus reads (4545 @ 100k budget, 9090 @ 200k: exactly linear; the kernel has no budget).

Fix (fix.diff -- validated)

Drain pf->cfe_head (STAILQ_REMOVE_HEAD + kfree) before kfree(pf) in the MFC reset, mirroring pccard_detach_card pccard.c:317-324.

• rig A/B: fixed_run.log (this pack) + matrix.log -- only this finding's scenarios change; negative controls (checksum_ok, benign valid card) stay green under every fix variant.
• kernel: see "Kernel-level fix validation" above.

Kernel references

• sys/bus/pccard/pccard_cis.c:635
• sys/bus/pccard/pccard_cis.c:638
• sys/bus/pccard/pccard_cis.c:641
• sys/bus/pccard/pccard_cis.c:644
• sys/bus/pccard/pccard_cis.c:908
• sys/bus/pccard/pccard_cis.c:909
• sys/bus/pccard/pccard_cis.c:916
• sys/bus/pccard/pccard.c:195
• sys/bus/pccard/pccard.c:317

Exploit chain

evil (or even valid MFC) card -> pccard_attach_card -> pccard_read_cis -> CISTPL_CONFIG allocs pf, CISTPL_CFTABLE_ENTRY allocs cfes onto pf->cfe_head, CISTPL_LONGLINK_MFC sets gotmfc=1, CISTPL_END reset kfrees the pf structs but not their cfe chains -> permanent kmalloc(M_DEVBUF) leak, N x 160 B per insertion; repeat per insert/eject, or loop with DF-5362 for unbounded heap exhaustion

Environment

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (audits) / booted fixed kernel #1 for fix validation (env.txt). cc 8.3 [DragonFly]. Artifacts: extract_manifest.txt (verbatim proof), run.log (baseline decisive), fixed_run.log (fix A/B), baseline_run.log (full pristine run), matrix.log (6x11 A/B), postboot_run.log (running-kernel source), env.txt, build.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.