DF-5380 — VERDICT

Finding: usb_quirk_get_entry() treats the all-zero key (vid|pid|lo_rev|hi_rev)==0 as "always return the LAST table slot" (sys/bus/u4b/quirk/usb_quirk.c:786-789) unconditionally — even after that slot has been allocated to a real dynamic entry — and the free-slot allocation path (usb_quirk.c:807-820) assigns vid/pid/lo_rev/hi_rev but never clears quirks[].

Reachability: /dev/usbctl → usb_static_ioctl (usb_dev.c:1707-1711) → usb_quirk_ioctl() USB_DEV_QUIRK_ADD/REMOVE (caps-gated, caps_priv_check_self(SYSCAP_NODRIVER) at usb_quirk.c:878/916 — verified EPERM for uid 1001, see run.user.log), and the boot-time kenv parser hw.usb.quirk.N → usb_quirk_add_entry_from_str (usb_quirk.c:994-1060). Both surfaces are root-only.

Reproduced? YES — deterministically, both aliasing modes

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (usb + usb_quirk compiled into X86_64_GENERIC; /dev/usbctl 0644 root:operator).

The table boots with 338 static entries (counted from source: lines 92-587, commented Olympus entries excluded) → 46 free slots (338..383).

• Scenario B — stale quirk inherited by a real entry. 1. USB_DEV_QUIRK_ADD{0,0,0,0,"UQ_HID_IGNORE"} → rc=0. The quirk parks in slot 383, which still looks free (vid|pid|lo|hi == 0 passes the free-scan test at usb_quirk.c:809-812). 2. 46 real ADDs (vid=0xA000+k, "UQ_CFG_INDEX_1"). The 46th allocates slot 383 without clearing quirks[]. 3. USB_DEV_QUIRK_GET shows entry[383]: vid=0xa02d carrying sub[0]=UQ_HID_IGNORE (never requested for that device) + sub[1]=UQ_CFG_INDEX_1. → device 0xa02d/0001 would be IGNORED by uhid(4) had it been real hardware. (run.log, run.2.log: SCENARIO_B_REPRODUCED.)

• Scenario A — all-zero ADD/REMOVE aliasing a live entry. With slot 383 holding the real entry, USB_DEV_QUIRK_ADD{0,0,0,0, "UQ_KBD_IGNORE"} → rc=0 and the quirk is appended to the LIVE entry (sub[2]=UQ_KBD_IGNORE); the matching all-zero REMOVE strips it (run.log: SCENARIO_A_REPRODUCED). The REMOVE path can also memset the whole live entry free when its quirk list empties (usb_quirk.c:949-957).

Reproduced twice with identical results (deterministic, no race involved). PoC cleans up after itself; final dump verified slots 338..383 free again.

Impact

Dynamic quirk-table state corruption: a real device entry can silently acquire quirks nobody requested for it (UQ_HID_IGNORE, UQ_KBD_IGNORE, UQ_MSC_IGNORE disable class drivers for the device) or lose/free its quirks. No memory-safety consequence: all writes stay inside quirks[8] (indices bounded by the first-UQ_NONE scan at usb_quirk.c:901-906 / the exact-match REMOVE loop at usb_quirk.c:939-944); the stored codes are plain uint16_t compared by equality. Attacker = root only (verified EPERM for unprivileged). Severity: Low. impact field: none (no memory corruption, no independent unprivileged DoS/leak).

Fix validated on the guest

fix.diff (2 hunks, git apply --check clean against the read-only tree): 1. all-zero key returns the reserved last slot only while it is still free, else NULL (callers already handle NULL: ADD → EINVAL, kenv → "table full"); 2. allocation clears quirks[] so a slot can never inherit stale sub-quirks.

Applied to the guest's /usr/src (pre-patch source sha256 matched this tree), make nativekernel KERNCONF=X86_64_GENERIC (fix_build.log contains the -c .../usb_quirk.c -Werror line and the completion banner), installed, rebooted into #1: Sat Oct 3 20:32:25 UTC 2026, and the identical PoC re-run (fix_run.log):

[+] all-zero ADD UQ_HID_IGNORE -> rc=0 (ok)          <- still allowed while scratch free
  entry[383].sub[0]: UQ_CFG_INDEX_1                  <- STALE quirk GONE
[-] SCENARIO_B_NOT_REPRODUCED (vid=0xa02d stale=0 real=1)
[+] all-zero ADD UQ_KBD_IGNORE on live table -> rc=-1 (Invalid argument)   <- alias refused
[-] SCENARIO_A_NOT_REPRODUCED
[+] cleanup verified: slots 338..383 all free again

Normal quirk add/get/remove behavior unchanged (46 real ADDs all rc=0, GET correct, REMOVE cleanup works). fix_status: fixed.

Negative results (pass-2 candidates hunted and killed)

• Non-NUL-terminated quirkname → strcmp OOB read: mapped_ioctl (sys/kern/sys_generic.c:655-683) copies exactly 64 bytes into an unzeroed 128-byte stack buffer (ubuf.stkbuf); quirkname[50] is the last field, so a user CAN hand the kernel a non-NUL-terminated name. BUT strcmp(pgq->quirkname, usb_quirkstr(y)) (usb_quirk.c:884, :922) compares against constants ≤ 24 chars and stops at the constant's NUL after ≤ 25 bytes — never reaches offset 64. No OOB. (Same for the GET path — _IOWR copyin echoes only the user's own bytes back; no kernel leak.)
• usb_strquirk quirk[len] OOB (usb_quirk.c:720-721): evaluated only when strncmp(str, quirk, len)==0; since str's segment is NUL-terminated at end (comma or EOS) and strncmp stops at the first NUL pair, the condition implies len == strlen(quirk) exactly → quirk[len] reads at most the terminator. No OOB.
• USB_DEV_QUIRK_GET index math (usb_quirk.c:847-851): x=index%8, y=index/8 with y>=384 → EINVAL; uint16 index can't overflow. Safe.
• Lock protocol: single private leaf lock (usb_quirk_lock), taken EXCLUSIVE on every reader (probe match usb_quirk.c:743, GET :852) and writer (ADD :894, REMOVE :932, kenv :1049); usb_quirk_get_entry asserts ownership (:784). No nesting → no inversion. Safe.
• Probe-path device data: usbd_lookup_info fields are only compared (==, <, >) — never used as indexes. Safe.
• usb_quirk_strtou16 (usb_quirk.c:972-986): boot-time kenv only; error path derefs a valid in-string pointer; *pptr=end+1 only on a matchable separator. Safe.
• envkey sizing (usb_quirk.c:1065): 16 bytes for "hw.usb.quirk." + 2 digits + NUL — exact fit. Safe.
• Module-unload grace (usb_dynamic.c:102-114 tsleep(hz) + this file's usb_quirk_uninit :1088-1095): acknowledged XXX tradeoff; root-triggered (kldunload) with a 1s grace; usb_quirk is compiled into GENERIC here. Root cause lives in usb_dynamic.c (different file). Not filed.
• DF-1047 (ADD/REMOVE name-lookup loop bound 384 vs 92) — known, not re-reported; its only reachable effect here ("UQ_UNKNOWN" stored as code 92) has no memory-safety consequence.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.