DF-5426 VERDICT — sys/bus/u4b/usb_handle_request.c pass 2

Mode: audit (pass 2, GLM 5.3). File: 804 LOC, gadget EP0 engine. Result: 1 Info hardening finding (this ID) + a verified negative result for everything else. Live evidence: production code executed in a KLD rig on the QEMU guest (DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026), 41/41 containment expectations met twice, zero guard-zone hits, zero panics, module load/unload clean.

What was audited and how the candidates died

The engine demultiplexes host-issued EP0 setups (req is 8 bytes of fully host-controlled data re-read from frbuffers[0] each callback, usb_handle_request.c:512), computes a per-fragment data length, and either copies into the ep0 DMA window (usbd_copy_in, :781) or aims the hardware at a provider buffer zero-copy (usbd_xfer_set_frame_data, :785). Fragment offsets derive from off = wLength - control_rem (:514-522) where control_rem is managed by usbd_setup_ctrl_transfer (usb_transfer.c:1507-1654: seeded once from wLength at :1548/:1464, monotone, len <= control_rem enforced at :1608, force_short_xfer -> control_rem = 0 at :1616-1617).

Candidate kill list (all traced at path:line, then live-checked):

1. :746 max_len -= off underflow (the ustorage pass-2 question). Three separate proofs it cannot fire in-tree: * Iface/driver path: the dispatcher does *plen += off (usb_handle_request.c:285) before returning, so max_len = (plen + off) - off ≡ plen (mod 2^16) — exact cancellation, for any driver, however lying. Rig: D01-D04 (conformant) and P2 (lying 1024→300) confirm max_len == plen. * Internal paths (GET_CONFIG len 1 :654, GET_STATUS len 2 :672, GET_EP_STATUS len 2 :736): off advances only by bytes previously delivered, each ≤ max_len = len - off; hence off ≤ len by induction. Rig I01-I09. * Template path (:644, full-length contract): same induction, providers are pure functions of the immutable re-read setup. * *The one feeder that can push off past the provider length — force_short_xfer zeroing control_rem (usb_transfer.c:1616) — forces rem == 0, and the if (max_len > rem) clamp (:753) zeroes max_len. Rig I02/I06/T02/T03/P1c.
2. :778-792 copy/DMA bounds. max_len ≤ min(1024, rem, provider_len - off); ep0 DMA geometry is 8 (setup) + 1024 (USB_EP0_BUFSIZE, usb_dragonfly.h:84; proxy rounding + REQ_SIZE, usb_transfer.c:666-727). usbd_copy_in therefore lands inside the window (rig mcopy-window check, I01-I09), and zero-copy windows stay inside provider objects for all conformant providers (T01-T12, D01- D04). GET_INTERFACE is served zero-copy from &iface->alt_index (:339) — 1 byte, contained (rig F03).
3. Uninitialized stack reads. temp union fully initialized on every read path (:652, :670, :732-734); completion-state gating (:543, :741) prevents stale reads. Rig E01-E03.
4. Sub-dev TOCTOU while the xfer lock is dropped (:232): the enum lock is held across dispatch (:235-352) and detach (usb_unconfigure, usb_device.c:486-524) takes the same lock. No window.
5. Broadcast iface iteration (:295-297): usbd_get_iface is bounds-checked (usb_device.c:2237-2244); iface_index is uint8_t and the loop ends at the first NULL/idesc-NULL iface. Rig F06 (walks 2 valid + stops at idesc==NULL), F04/F05 (wIndex 3/255).
6. SET_INTERFACE/alt, endpoint halts, set-address, set-config: alt validated against usbd_get_no_alts over the kernel-built config (:193, :314-329, rig F01/F02); usbd_get_ep_by_addr masked and bounded (usb_device.c:177-217); usbd_set_endpoint_stall NULL-ep-safe (usb_device.c:976-986, rig I13-I15); address ≥ 0x80 stalled and 7-bit masked (:677/:685, rig I10-I12); conf_no-- guarded by the UNCONFIG branch (:156-164) and the descriptor lookup bounds the index (rig: SET_CONFIG not runtime-driven — it needs a configured device graph; static trace only).
7. Scratch/template lifecycle: descriptors live in the udev->usb_template_ptr heap block / static string tables; freed only from usb_free_device after usbd_transfer_unsetup of the ctrl xfers (usb_device.c:2183→2186) — no host-reachable UAF window. Vendor/string providers are pure functions of req (usb_template_msc.c:173-193, usb_template_mouse.c:…, modem NULL).
8. Stale zero-copy frame pointers: both frame buffers are reset to local_buffer+{0,8} on every callback (:507-508).
9. Diff vs FreeBSD main: functionally byte-identical (headers/ cosmetics only) — no missed upstream fix.

The finding (DF-5426, Info, hardening)

max_len -= off (:746) has no explicit underflow guard. The in-tree safety rests on two implicit invariants — the mod-2^16 cancellation (:285) and provider-length immutability within one control transfer. Nothing in the file enforces the second. If a provider's length ever shrinks below the already-transferred offset (out-of-tree usb_temp_get_desc_p override, or a future in-tree provider that rebuilds descriptors per call), max_len wraps; the :750/:753 clamps bound it to 1024 (and rem) but not to the provider object: the frame window [src_zcopy + off, +max_len) escapes the object by up to 1024 + off - real_len bytes per fragment.

Rig proof on the production code (baseline run): * P1a — provider shrinks 4096→100 at off=1024, wLength=4096: fragments 2..4 read [base+1024, base+2048), [+2048, +3072), [+3072, +4096) from a 100-byte object — escapes of 1948/2972/3996 bytes (IN direction ⇒ OOB DMA read of adjacent kernel memory to the hostile host). esc_bytes=8916 total. * P1b — shrink 1024→4 at off=1024: escapes of 2044/3068/4092 bytes. esc_bytes=9204. * P1c — shrink 200→4 with wLength=0xFFFF: the force_short_xfer termination (:764-770 + usb_transfer.c:1616) ends the transfer after fragment 1 — this shape cannot reach fragment 2 (contained). * P2 — the same class via a lying sub-driver through the real kobj USB_HANDLE_REQUEST dispatch: plen 1024 then 300 at off>0 (cancellation makes max_len = 300 exactly); window escapes the driver's 1024-byte buffer by 300 bytes per fragment; for an OUT (host→device) request the same window is the DMA write target — host-controlled heap overflow past the driver object. Pure driver-contract violation; no in-tree driver does this (g_audio.c:544-620, umodem.c, ustorage_fs.c, g_ all use the offset==0 ? size : 0 idiom). * P3* — driver sets *plen but not *pptr: NULL frame pointer with nonzero length (:785 USB_ADD_BYTES(NULL, off)).

None of P1/P2/P3 is reachable through in-tree code (all in-tree providers are pure functions of the immutable setup bytes, and the function-pointer usb_temp_get_desc_p is only writable by kernel code). Hence Info severity / defense-in-depth, not an exploit path.

Fix and validation

fix.diff (authored after verification, never applied to sys/):

-   max_len -= off;
+   if (max_len < off) {
+       /* length wrapped around - avoid underflow */
+       max_len = 0;
+   } else {
+       max_len -= off;
+   }

Validated by rebuilding the identical rig against a patched copy of the production file (md5 7d86c182…):

• baseline: contained=41 failed=0 latent-primitives=4 (P1a/P1b wrap escapes present),
• patched: contained=43 failed=0 latent-primitives=2 — P1a/P1b now escaped=0, terminating cleanly with a status stage after the honest prefix (frags=3 sent=1024); all 41 conformant cases byte-identical (the guard is a no-op when max_len >= off, which the induction guarantees for conformant providers).
• P2/P3 persist by design: they are third-party driver-contract violations that this layer cannot detect (the kernel does not know the provider's real object size); the :750/:753 clamps remain the only bound.

Rig-harness notes (honesty section)

• The rig models the callback context: xfer lock held across usb_handle_request() (the usb_handle_set_stall / usb_handle_iface_request unlock/relock paths give it back held).
• control_rem lifecycle replicated exactly (init-once-from-wLength, len<=control_rem assert, force_short → 0); a mismatch would have printed BOOKKEEPING VIOLATION (never fired).
• Two rig-side iteration artifacts were fixed during bring-up (completion-fragment counting, GET_INTERFACE zero-copy classification); the production code was never modified for the baseline runs.
• One guest panic occurred during harness bring-up and was a RIG bug (missing lock discipline), not production behavior; the guest was reset (vm.sh reset with-src) and all reported runs are from the clean snapshot.
• usb_handle_set_config / remote-wakeup paths were traced statically only (they need a configured device graph / bus explore machinery); neither manipulates host-controlled lengths.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.