DF-5395 — if_axge.c attach-failure DF-5334/DF-5384-class panic (goto-detach-on-unattached)

What

axge_attach() (sys/bus/u4b/net/if_axge.c) routes its device-controlled failure branch through axge_detach() on a usb_ether that was never attached — identical class to DF-5334 (if_cdce.c) and DF-5384 (if_aue.c):

• usbd_transfer_setup() fails (missing bulk-in/out endpoints on an otherwise matching ASIX device) → if_axge.c:555-558 goto detach → if_axge.c:573-575 axge_detach(dev).
• At that point ue->ue_lock, ue_dev, ue_udev, ue_methods, ue_tq are ALL still zero — they are assigned only at if_axge.c:560-564, after the failing call (only lockinit(&sc->sc_lock) at :550 and device_set_usb_desc() at :549 have run).
• axge_detach() (if_axge.c:587) calls uether_ifdetach(ue) (usb_ethernet.c:267-305): usb_proc_drain() is a no-op on the zeroed ue_tq; uether_getifp() returns the embedded arpcom ifnet (never NULL — the if (ifp != NULL) guard is dead code); then usb_ethernet.c:281 UE_LOCK(ue) = lockmgr(NULL, LK_EXCLUSIVE) → Fatal trap 12, fault VA 0x0.

The second failure branch (uether_ifattach() error, if_axge.c:566-570) has the same shape and additionally reaches ether_ifdetach() on a never-if_attach()ed ifnet → ifindex2ifnet[0] nulling + global ifnet list corruption + double devfs_clone_bitmap_put() of ue_unit (requires usb_proc_create() ENOMEM — not attacker-timed).

Threat model: attacker-supplied USB device (evil adapter / evil dock / VM USB attach) presenting any of the 4 VID:PID pairs in axge_devs[] (ASIX AX88179 0b95:1790, AX88178A 0b95:178a, D-Link DUB1312 2001:4a00, Sitecom LN032 0df6:062c) at config index 0 / iface 0 without the bulk-in/out endpoints axge_config[] requires. Not remotely triggerable, not an unprivileged-local program — physical/VM USB access.

Reproduce (evidence class: KLD harness driving production code)

QEMU cannot emulate an AX88179. The harness axge_attach_poc.c replays axge_detach() verbatim (its two production calls, in order) on the exact state axge_attach()'s failure branch produces, using the production usbd_transfer_unsetup() and uether_ifdetach() (exported by uether.ko). The only non-production code is the static axge_attach/axge_detach frame itself (they are static in if_axge.c and only reachable via goto detach with a physical device present).

# build (in guest; pack synced to /root/df5395)
cd /root/df5395 && make -m /usr/src/share/mk

# run (auto-loads STOCK /boot/kernel/uether.ko as dependency)
kldload -v ./axge_poc.ko
# expected: 3 marker lines, then
#   Fatal trap 12: page fault while in kernel mode
#   fault virtual address = 0x0
#   Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi
#   (guest dead in DDB)

Fix validation

fix.diff (git-apply-able against clean sys/): (a) class-wide guard in uether_ifdetach() — early return when ue->ue_lock == NULL (same fix already validated for DF-5334/DF-5384); (b) axge_attach() routes both pre-attach failure branches to a local detach_usb: label doing only usbd_transfer_unsetup() + lockuninit() (fixes the branch-2 ether_ifdetach-on-unattached corruption too).

Applied to the guest's /usr/src (patch(1) Plan A, all hunks), both modules (uether.ko, if_axge.ko) rebuilt -Werror clean, patched uether.ko installed: the identical harness run prints axge_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg | grep -c 'Fatal trap' = 0, clean kldunload (twice — stable), and the patched if_axge.ko driver module loads/unloads clean. See run.log vs panic.txt.

Files

• axge_attach_poc.c + Makefile — the harness
• build.sh / run.sh — exact build/run commands
• build.log — harness build (full, -Werror)
• fix_uether_build.log / fix_if_axge_build.log — patched module builds
• panic.txt — baseline serial record (stock modules)
• run.log — patched runs (survival proof, 2x)
• env.txt — guest uname, kldstat, dmesg
• fix.diff — the fix (never applied to the audit tree)
• VERDICT.md, manifest.json, verdict.json

DF-5395 VERDICT — REPRODUCED (panic), fixed

Finding. axge_attach() (sys/bus/u4b/net/if_axge.c) has the DF-5334/DF-5384 "goto-detach-on-unattached" pattern: the usbd_transfer_setup() failure branch (if_axge.c:555-558) and the uether_ifattach() failure branch (if_axge.c:566-570) both jump to detach: (if_axge.c:573-575) and call the full axge_detach(dev), which calls uether_ifdetach(&sc->sc_ue) (if_axge.c:587) on a usb_ether that was never attached.

Why it faults. On the transfer-setup failure path, every ue field that uether_ifdetach() needs is still zero because they are assigned only at if_axge.c:560-564 — after the failing call (before it, only device_set_usb_desc() at :549 and lockinit(&sc->sc_lock) at :550 have touched the softc):

• usb_proc_drain(&ue->ue_tq) (usb_ethernet.c:273) returns immediately (up->up_lock == NULL, usb_process.c:406-410) — no fault, no initialization.
• ifp = uether_getifp(ue) (usb_ethernet.c:276) returns &ue->ue_arpcom.ac_if — never NULL, so the if (ifp != NULL) guard at :278 is dead code (same as DF-5334/DF-5384).
• UE_LOCK(ue) (usb_ethernet.c:281, macro at :61) is lockmgr(ue->ue_lock /* NULL */, LK_EXCLUSIVE) → read at VA 0x0 → Fatal trap 12.

The second branch (uether_ifattach error) leaves ue_lock valid but the ifnet never if_attach()ed and ue_watchdog never usb_callout_init()ed; uether_ifdetach() proceeds to ether_ifdetach() (usb_ethernet.c:294) → if_detach() on a never-attached ifnet → ifindex2ifnet[0] nulling + TAILQ_REMOVE of a never-inserted ifnet from the global ifnet list + double devfs_clone_bitmap_put() of ue_unit (first put already happened in ue_attach_post_task fail path, usb_ethernet.c:262) — latent list/unit corruption pre-empted on branch 1 by the NULL-write fault. Branch 2 needs usb_proc_create() to fail (ENOMEM), so it is not attacker-timed; the transfer-setup branch is fully device-controlled: any USB device exposing one of the 4 axge_devs[] VID:PID pairs (ASIX AX88179 0b95:1790, AX88178A 0b95:178a, D-Link DUB1312 2001:4a00, Sitecom LN032 0df6:062c) at config 0 / iface 0 while omitting the bulk-IN/OUT endpoints makes usbd_transfer_setup() fail (USB_ERR_NO_ENDPOINT / USB_ERR_NO_PIPE) at plug-in.

Verification (evidence class: KLD harness driving production code — QEMU cannot emulate an AX88179; axge_attach/axge_detach are static and reachable only with hardware):

• The harness (axge_attach_poc.c) constructs the exact post-failure state (zeroed struct axge_softc + lockinit(&sc->sc_lock) per if_axge.c:550 — the only lock initialisation before the failing call at :553) and replays axge_detach() verbatim: the production usbd_transfer_unsetup() then the production uether_ifdetach().
• Baseline (pristine with-src guest, stock /boot/kernel/uether.ko auto-loaded by MODULE_DEPEND): the three markers print (ue_lock=0 ue_dev=0 ue_udev=0 ue_tq.up_lock=0 — the exact branch-1 state), then Fatal trap 12: page fault while in kernel mode, fault virtual address = 0x0, Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi — guest dead at DDB (panic.txt). 1/1 run (deterministic NULL deref; the same sink was already proved 3/3 in-situ for the class in DF-5334/5384).
• Patched (fix.diff applied to guest /usr/src via patch(1) Plan A, all hunks; uether.ko + if_axge.ko rebuilt -Werror clean; patched uether.ko into /boot/kernel): the identical harness run prints axge_poc: SURVIVED uether_ifdetach() (the guard's early return), KLDLOAD_RC=0, dmesg | grep -c 'Fatal trap' = 0, kldunload clean — run twice, stable — and the patched if_axge.ko driver module loads/unloads clean (run.log, fix_uether_build.log, fix_if_axge_build.log).

Impact. Plug-time kernel NULL dereference (panic/DoS) from a malicious USB device — same severity tier and threat model as DF-5334/DF-5384 (Medium, physical/VM USB access). NOT memory corruption with attacker-controlled data: the fault address is fixed VA 0, the only "dereference" is the lockmgr read of the lock word at NULL. No user→root route. The latent branch-2 second stage (ifindex/ifnetlist corruption) is likewise plug-time corruption of fixed addresses — DoS.

Why this is a separate finding from DF-5334/DF-5384. Those were filed against if_cdce.c and if_aue.c; the tree still carries the unguarded uether_ifdetach (their in-guest fixes were reverted after validation), and every uether driver's attach-failure path is an independent instance. This finding covers the if_axge.c instance (root cause identical, trigger device-controlled the same way).

Fix. fix.diff: (a) uether_ifdetach() early-returns when ue->ue_lock == NULL (class-wide, matches the DF-5334/DF-5384 validated fix); (b) axge_attach() routes both pre-attach failures to detach_usb: doing only usbd_transfer_unsetup() + lockuninit() — (b) is required for the branch-2 ether_ifdetach-on-unattached corruption, which (a) alone does not stop. Validated in-guest (baseline panic gone, both modules -Werror clean, driver loads).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.