DF-5444 — pnp_set_config() panics on card-supplied misaligned memory base (sys/bus/isa/pnp.c:260-261)

What

pnp_set_config() (the ISA_SET_CONFIG_CALLBACK installed by pnp_create_devices, pnp.c:456-457) executes panic("pnp_set_config: bogus memory assignment") when the assigned memory base has bits below 0x100 set. The base is card-controlled end-to-end:

• pnp_parse_desc() PNP_TAG_MEMORY32_RANGE stores a fully arbitrary 32-bit ir_start and ir_align from the card (pnpparse.c:295-300) — no 256-byte granularity clamp (unlike PNP_TAG_MEMORY_RANGE at pnpparse.c:266-269 which forces align ≥ 0x10000);
• isa_find_memory() (isa_common.c:128-148) starts its candidate loop at the card-supplied ir_start and steps by MAX(align,1) — with align=1 the first candidate is the misaligned base itself;
• the config callback then panics (pnp.c:260-261).

Same reachability for PNP_TAG_MEMORY32_FIXED (pnpparse.c:323-328, align=1, fixed base).

Trigger model

Crafted ISA-PnP card (or emulated/counterfeit PnP device in a VM) declaring a logical device with MEMORY32_RANGE base=0xE0001001 align=1 size=1. Boot-time / driver-load-time kernel panic = DoS (DS_ATTACHED-gated identify notwithstanding: the kldload→isa_driver_added path runs the whole engine, see DF-5392).

Rig

Same rig/ as DF-5443 (verbatim pnp.c engine + virtual card). Module hack_dfb (script 2): card declares one logical device with the misaligned MEMORY32_RANGE above and a valid END tag. pnp_create_devices (real code) creates the child with the real pnp_set_config callback; isa_driver_added's child loop (isa_common.c:835-862) then runs isa_assign_resources → callback → panic.

Build / Run

(cd /usr/src/sys/bus/isa/hack_dfb && make obj && make depend && make)
kldload /usr/obj/usr/src/sys/bus/isa/hack_dfb/rigdfb.ko

Expected

Baseline: panic: pnp_set_config: bogus memory assignment, trace pnp_set_config <- isa_assign_resources <- isa_driver_added <- devclass_add_driver.

Fixed kernel (fix.diff: pnpparse.c clamps MEMORY32_* granularity to 0x100 and rounds bases to 256; pnp.c degrades gracefully instead of panicking): no panic, warning printed, kldload returns 0.

DF-5444 VERDICT — REPRODUCED (kernel panic; card-driven DoS)

Bottom line

panic("pnp_set_config: bogus memory assignment") (sys/bus/isa/pnp.c:261) was triggered through the real kernel flow on the guest by a card declaring MEMORY32_RANGE base=0xE0001001 align=1 size=1. The single-fix kernel (fix.diff) turns the identical stream into a graceful resource rejection.

Chain (all real code; rig only virtualizes the card's port behaviour)

1. Card bytes → pnp_parse_desc() PNP_TAG_MEMORY32_RANGE stores arbitrary 32-bit ir_start/ir_align — no 256-byte granularity clamp (pnpparse.c:295-300), unlike PNP_TAG_MEMORY_RANGE which forces align ≥ 0x10000 (pnpparse.c:266-269).
2. isa_driver_added() child loop (isa_common.c:835-862) → isa_assign_resources() → isa_find_memory() (isa_common.c:128-148): candidate loop starts at the card base and steps by MAX(align,1) — with align=1 the first candidate is the misaligned base; rman grants it (0xE0001001 is free on this guest).
3. Config callback = the real pnp_set_config (installed at pnp.c:456-457) → start & 0xff → panic (pnp.c:260-261).

Same reachability via PNP_TAG_MEMORY32_FIXED (pnpparse.c:323-328: fixed arbitrary base, align=1).

Evidence

Baseline (kernel #0): panic.txt / serial_runB_full.log —

panic: pnp_set_config: bogus memory assignment
pnp_set_config() at pnp_set_config+0x192
isa_assign_resources() at isa_assign_resources+0x9e7
isa_driver_added() at isa_driver_added+0x106
devclass_add_driver() ... module_register_init()

Fixed (kernel #1, fix.diff): fix_run.log — RUN_B_RC=0, (null) can't assign resources (memory) (rounded base no longer fits the 1-byte window → config rejected → device disabled), guest healthy.

Fix

pnpparse.c: MEMORY32_RANGE/MEMORY32_FIXED granularity clamped to 0x100 with bases rounded up; pnp.c: panic downgraded to kprintf + truncation (defense in depth). Validated above; full diff in fix.diff (shared with the DF-5443/DF-5445 packs; build log in DF-5443/fix_build.log).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)