DF-5452 VERDICT — REPRODUCED (unguarded irq_rman[cpuid] index; debug-only assert)

Finding

nexus_alloc_resource() — sys/platform/pc64/x86_64/nexus.c:346-418 — selects rm = &irq_rman[cpuid] for SYS_RES_IRQ where the ONLY validation is KASSERT(cpuid >= 0 && cpuid < ncpus) (nexus.c:377-378). In DragonFly, KASSERT compiles to a no-op unless options INVARIANTS is set (sys/sys/systm.h:94-112). The public driver API bus_alloc_resource() (sys/kern/subr_bus.c:3293-3300) passes cpuid = -1 for every explicit-range allocation. In-tree callers survive because every intermediate bus that uses resource_list_alloc() overrides cpuid with rle->cpuid, and all in-tree IRQ resource setters pass machintr_legacy_intr_cpuid() (pci.c:2815-2816, acpi_resource.c:577-578,599-600, Osd/OsdInterrupt.c:95-96, isahint.c:74-75, isa_common.c:286). A nexus child (or a grandchild behind a passthrough-only bus) that calls bus_alloc_resource(dev, SYS_RES_IRQ, &rid, irq, irq, 1, ...) — the obvious API use — reaches nexus with cpuid = -1: - INVARIANTS kernels: panic: nexus invalid cpuid: -1; - production kernels without INVARIANTS: rm = &irq_rman[-1] — 80 bytes (sizeof(struct rman), measured on the guest) below the array — handed to rman_reserve_resource() which takes lwkt_gettoken(rm->rm_slock) and walks/inserts rm->rm_list: an out-of-bounds struct-rman interpretation of unrelated static storage (silent NULL when the preceding BSS is zeroed; wild token/TAILQ reads and writes when it is not).

Reproduction (baseline, kernel #0 Jul 2 2026, INVARIANTS present)

KLD nxirq.ko (nexus child), see panic.txt: - leg 1: bus_alloc_legacy_irq_resource(dev, &rid, 5, RF_SHAREABLE) (subr_bus.c:3302-3309, valid cpuid) — SUCCEEDED (res=0xfffff800895d0868); same vector, same rmans. - leg 2: bus_alloc_resource(dev, SYS_RES_IRQ, &rid, 5, 5, 1, RF_SHAREABLE) — immediate panic: nexus invalid cpuid: -1 in nexus_alloc_resource, called from bus_alloc_resource (full backtrace in panic.txt).

Impact

Denial of service (clean panic) via any buggy driver on INVARIANTS kernels; uncontrolled out-of-bounds kernel static access on production kernels built without INVARIANTS (a supported configuration; X86_64_GENERIC ships with INVARIANTS, custom/performance kernels routinely omit it). No in-tree trigger today — this is a driver-API-boundary hardening defect. Severity Low.

Fix validation (kernel #1 Oct 5 17:59:42)

fix.diff replaces the KASSERT with a real bounds check that returns NULL with a diagnostic. Patched result (fix_run.log): leg 1 still succeeds; leg 2 prints nexus_alloc_resource: invalid cpuid -1 for SYS_RES_IRQ allocation and returns res=0 — no panic; module attaches; guest healthy; normal boot with all nexus IRQ allocations unchanged.

Kernel refs

sys/platform/pc64/x86_64/nexus.c:346-398 (index at 377-379) sys/sys/systm.h:94-112 (KASSERT/KKASSERT INVARIANTS-gated) sys/kern/subr_bus.c:3293-3300 (cpuid = -1 default), 3302-3309 sys/kern/subr_rman.c:221-231 (token + TAILQ walk on the bogus rman)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.