DF-5458 PoC — ichsmb_bread's count contract is broken in both directions; /dev/smb passes an uninitialized stack byte

Root cause

• ichsmb_bread() (ichsmb.c:416-461) treats *count as INPUT (validated 1..32 at ichsmb.c:424 and transmitted to the device as the expected block count in ICH_D0 at ichsmb.c:436 /* XXX? */) and as OUTPUT (overwritten with the received count at :441).
• The only userland caller, smbioctl SMB_BREAD (smb.c:318-330), passes u_char bcount; declared uninitialized (smb.c:217) — ichsmb_bread validates and transmits stale kernel stack garbage.
• Observable effects: SMB_BREAD fails with EINVAL whenever the stale byte is 0 or >32 (on this rig: deterministically, i.e. the block-read interface is dead), and when it happens to pass the gate, a garbage "expected count" is written to the ICH_D0 device register.

Live result (q35 rig, QEMU smbus-ipmi BMC at 0x20 answering real SSIF traffic)

BWRITE cmd=2 (SSIF req)            rc= 0      <- block-write path fully works
BREAD  cmd=3 (SSIF rsp)            rc=-1 errno=22 (EINVAL)   <- every time
... 12 further BREAD attempts, stack-dirtying syscalls in between: all EINVAL

The BMC is present and answering (BWRITE succeeds; the fixed module below reads real IPMI data through the identical path), proving the EINVAL comes from the uninitialized count gate, not from the bus.

Fix validation (same run as DF-5459's pack)

fix.diff: initialize bcount = 32 in smb.c and make ichsmb_bread clamp an invalid input instead of rejecting it (expect = (*count >= 1 && *count <= 32) ? *count : 32). With the patched modules, on the identical rig:

BREAD  cmd=3 (SSIF rsp)            rc= 0 errno=0 rcount=3 data=06 18 00 ...
fresh-process BREAD x3             rc= 0 ... (every attempt)
BREAD slave=0x50 cmd=1 (DDC)       rc=-1 errno=35 (clean timeout error, no garbage gate)

i.e. the interface goes from deterministically-broken to working.

Build & run

guest: cc -O0 -o /root/df5457_poc /root/df5457_poc.c
vm.sh run_root 'kldload ichsmb && kldload smb && /root/df5457_poc dev && /root/df5457_poc uninit'

DF-5458 VERDICT — REPRODUCED (uninitialized kernel-stack byte gates and drives a device register) — fix validated

Bottom line

ichsmb_bread() consumes its *count parameter as an input bound AND as the output count (ichsmb.c:424 validate 1..32, :436 write to ICH_D0 "XXX?", :441 overwrite), but the only caller (smb.c smbioctl SMB_BREAD) passes u_char bcount; that is never initialized (smb.c:217). The result is: (1) SMB_BREAD is deterministically broken (EINVAL) whenever the stale kernel stack byte at that slot is 0 or >32 — on this rig it is, for every attempt, so the entire block-read interface is dead through /dev/smb; (2) when the garbage passes the gate, a junk "expected count" byte is written to the ICH SMBus device register ICH_D0.

Evidence

baseline_run.log (uninit section): 13/13 SMB_BREAD attempts → errno=22 (EINVAL) against a BMC that answers the request (the paired BWRITE succeeds; with the fixed module the identical BREAD returns real IPMI bytes). Stack dirtying between calls (pipe write/read) did not change the slot — the byte sits above all callee frames and only smbioctl itself can write it, so on this guest it stays a stable invalid value.

fixed_run.log: with fix.diff (smb.c bcount = 32 + ichsmb_bread clamping the input), every BREAD succeeds: rc=0 rcount=3 data=06 18 00, fresh-process reads included; the DDC transaction now returns a clean timeout errno (35) instead of the garbage gate.

Impact

Functional denial of the SMB_BREAD interface driven by uninitialized kernel memory + transmission of a garbage count byte to the SMBus host controller. Not memory-unsafe by itself (all copies stay bounded by min()), but it is the same contract break whose write side (returning block_count unclamped) is DF-5457, and it makes the whole /dev/smb block-read API unusable on stock systems (users have no way to initialize the byte).

Fix

fix.diff in this pack (shared with DF-5457/DF-5459): smb.c initializes bcount = 32; ichsmb_bread no longer rejects on stale input — it clamps (expect), transmits expect to ICH_D0, and copies/returns min(block_count, 32).

Kernel references

sys/bus/smbus/ichsmb/ichsmb.c:424,436,440-441; sys/dev/smbus/smb/smb.c:217,318-330

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.