DF-5447 — uvscom_pre_param() inverted switch: every baud rate (including all

11 supported ones) is rejected with EINVAL

The bug (production code, sys/bus/u4b/serial/uvscom.c:514-533)

static int
uvscom_pre_param(struct ucom_softc *ucom, struct termios *t)
{
    switch (t->c_ospeed) {
        case B150:
        case B300:
        ...
        case B115200:
        default:
        return (EINVAL);      <-- EVERY path, supported speeds included
    }
    return (0);                       <-- unreachable (dead code)
}

All eleven case labels (the exact speeds the hardware supports and that uvscom_cfg_param() uvscom.c:543-579 knows how to program) fall straight into return (EINVAL). The trailing return (0) is unreachable. This is a transcription inversion of the NetBSD original (NetBSD uvscom.c uvscom_pre_param returns 0 for the listed speeds and EINVAL only for default:).

Impact

ucom_param() (sys/bus/u4b/serial/usb_serial.c:1678-1684) uses the ucom_pre_param callback to validate termios and bails out with the error before queueing ucom_cfg_param (usb_serial.c:1691-1693). Consequence on a live uvscom adapter:

• every tcsetattr(2) / TIOCSETA on /dev/ttyU0.* (or the cua device) fails with EINVAL — the port can never be programmed (baud, parity, stop bits);
• ucom_open()'s own initial programming call (usb_serial.c:842, ucom_param(tp, &t), error discarded) also fails silently, so uvscom_cfg_param() never executes at all — the device is never given UVSCOM_SET_SPEED / UVSCOM_SET_PARAM (uvscom.c:581,614);
• the tty is stuck at the default termios forever. Fails closed (EINVAL), no memory-safety impact — a functional kill of the serial port.

An attacker who supplies a crafted "SUNTAC" USB adapter (or a user of a real one) gets a /dev/ttyU0 that silently never works: every stty fails. Driver is dead weight for its entire user base.

Evidence class

No SUNTAC VID:PID device model exists for the QEMU guest — KLD-harness-with-production-code: the harness #includes the production sys/bus/u4b/serial/uvscom.c verbatim (module-registration macros neutered so it does not double-register on uhub) and calls the real, static uvscom_pre_param() for every supported speed. Baseline: all return EINVAL. After fix.diff: supported speeds return 0, B230400 returns EINVAL.

Reproduce

./build.sh    # in-tree kmod build: cd /usr/src/sys/bus/u4b/serial/hx5447 && make
./run.sh      # kldload the harness; dmesg shows per-speed results

Expected baseline dmesg: UVS5447[A]: pre_param(B9600) = 35 (EINVAL) for ALL eleven supported speeds, UVS5447[A]: SUPPORTED speeds accepted: 0/11 (BUG). Expected after fix.diff (phase B rerun): accepted: 11/11, B230400 = EINVAL.

Files

• uvscom_preparam_harness.c — production-code KLD harness
• Makefile, build.sh, run.sh
• build.log, run.log, run.fixed.log — full untrimmed output
• fix.diff — git-apply-able fix (restore intended switch)
• VERDICT.md, manifest.json, verdict.json

DF-5447 VERDICT — uvscom_pre_param() inverted switch

Status: REPRODUCED (production code) — impact: functional DoS of the serial port (fails closed); fix validated behaviorally on the guest.

What was run

KLD-harness-with-production-code (no SUNTAC VID:PID device model exists for QEMU): uvscom_preparam_harness.c #includes the unmodified production sys/bus/u4b/serial/uvscom.c (newbus DRIVER_MODULE/MODULE_DEPEND/ MODULE_VERSION registration macros expanded to nothing so no second "uvscom" driver registers on uhub) and calls the real, file-static uvscom_pre_param() (uvscom.c:514-533) for every baud rate the driver itself lists as supported.

Baseline (run.log)

UVS5447[A]: calling production uvscom_pre_param() (uvscom.c:514-533) for all 11 supported speeds
UVS5447[A]: pre_param(B150)     = 22 (EINVAL -- REJECTED)
   ... (B300 B600 B1200 B2400 B4800 B9600 B19200 B38400 B57600 B115200) ...
UVS5447[A]: pre_param(B230400)  = 22 (ok, expected EINVAL)
UVS5447[A]: SUPPORTED speeds accepted: 0/11 (BUG: every tcsetattr fails EINVAL,
              uvscom_cfg_param() is unreachable, uvscom.c:532 return(0) dead)

All eleven supported speeds return EINVAL(22). The return (0) at uvscom.c:532 is unreachable dead code — every path through the switch, including the eleven listed cases, falls into return (EINVAL) at line 530. This is a transcription inversion of the NetBSD original (supported speeds → return (0), only default: → return (EINVAL)).

Why it matters (production call path, cited)

• ucom_param() uses this callback to validate every termios change: usb_serial.c:1678-1684 — non-zero return ⇒ goto done with the error ⇒ every tcsetattr(2)/TIOCSETA on the tty fails with EINVAL and ucom_cfg_param is never queued (usb_serial.c:1691-1693).
• ucom_open()'s initial programming call also fails (error discarded, usb_serial.c:842) ⇒ uvscom_cfg_param() (uvscom.c:535-615) never executes on any open — the device never receives UVSCOM_SET_SPEED / UVSCOM_SET_PARAM (uvscom.c:581,614).
• Net effect: the port is permanently locked to default termios; the driver is functionally dead for its whole user base. Fails closed (EINVAL), no memory-safety impact.

Fix validation (run.fixed.log / fix_run.log)

fix.diff applied to the guest's /usr/src copy of uvscom.c, same harness rebuilt (build log in fix_build.log, -Werror clean), re-run:

UVS5447[A]: SUPPORTED speeds accepted: 0/11 (BUG: ...)     <- baseline dmesg leftover
UVS5447[A]: SUPPORTED speeds accepted: 11/11 (fixed)

With the fix, all eleven supported speeds are accepted and unsupported speeds (B230400) still return EINVAL. Baseline bad behavior GONE.

PoC bring-up notes (what had to be fixed vs. a naive include)

1. #include <sys/termios.h> does not exist for -nostdinc kernel builds → <sys/tty.h> (which pulls <sys/_termios.h>).
2. The harness prelude must NOT include any bus/u4b/* headers before including uvscom.c: usb_debug.h's include guard would suppress uvscom.c's own #define USB_DEBUG_VAR uvscom_debug-first include, leaving DPRINTF/DPRINTFN undefined (implicit/nested-extern errors under -Werror).
3. uvscom_devclass / uvscom_driver become unused when DRIVER_MODULE is neutered → referenced from a harness function to stay -Werror clean.

Environment

See env.txt: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026, X86_64_GENERIC, cc 8.3, guest left pristine (uvscom.c md5 a58a99ef02d63a2d2e7f7b661f5224b3 restored, harness dirs removed, no leftover KLDs).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.