DF-5465 VERDICT — reproduced (silent OOB RMW write + wild-index panic), driver-facing legacy-config ABI, Low severity

Bottom line

REPRODUCED on the production-behaviour kernel (X86_64_NOINV; stock GENERIC equally affected): icu_abi_legacy_intr_config() (icu_abi.c:366-397) validates its driver-supplied irq only with KKASSERTs compiled out of production kernels. A driver calling bus_config_intr() / MachIntrABI_ICU.legacy_intr_config():

• irq=1000: silently performs the OOB read-modify-WRITE map->im_flags |= ICU_IMF_CONF (icu_abi.c:379) and map->im_trig = trig (:389) at &icu_irqmaps[0][1000] (+16000 bytes — another CPU's map row), then calls elcr_write_trigger(1000, ...) (elcr.c:70-92) whose KASSERT is likewise gone (UB 1 << irq shift + outb to the ELCR port) — returns void, no error, guest apparently healthy.
• irq=-100000000: Fatal trap 12: page fault while in kernel mode, fault virtual address = 0xffffffff2238a42c (= icu_irqmaps base 0xffffffff81a00420 − 0x5F5E1000 + 0xc — exactly the im_flags field of element −100000000), fault code = supervisor write data, ** Stopped at icu_abi_legacy_intr_config+0x25: orl $0x1,0xc(%rbx)** — the |= RMW at icu_abi.c:379 faulting on a wild negative index.

On the INVARIANTS kernel the same call panics at the KKASSERT (icu_abi.c:373) — either way a driver bug is promoted to a kernel panic; on production kernels it is first a silent 16-byte-strided OOB write primitive at a driver-chosen offset.

How it was reproduced (baseline X86_64_NOINV, run.log / panic_wild_irq.txt)

icu_legacy_probe: step1 legacy_intr_config(1000, EDGE, HIGH): ...
icu_legacy_probe: step1 RETURNED WITHOUT ERROR (void) -- OOB write done
icu_legacy_probe: step2 legacy_intr_config(-100000000, ...): ...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffff2238a42c
fault code = supervisor write data, page not present
Stopped at icu_abi_legacy_intr_config+0x25: orl $0x1,0xc(%rbx)
db>

The faulting instruction is byte-for-byte the predicted RMW (im_flags at struct offset 0xc of a 16-byte element).

Primitive characterization

16-byte-strided OOB write at an attacker/driver-chosen index with partially-fixed contents (|1 RMW on im_flags; small enum into im_trig), plus the ELCR shadow/port write with a wild irq. Moderate indices corrupt other CPUs' map rows silently; wild indices panic. Same production-no-op-guard class as DF-5352 (ioapic twin); same-class bullets folded into this finding: icu_abi_intr_enable/disable/setup/ teardown KASSERT-only bounds (icu_abi.c:178,:196,:263,:287) and icu_abi_msi_map type/base KASSERTs only (icu_abi.c:628-634, silently wrong msi_map(-1,...) hardware values). Trigger requires a driver-facing call — already-privileged — hence Low severity.

Fix validation (fix.diff, applied to guest /usr/src, incremental rebuild)

Identical PoC on the fixed kernel (run_fixed.log):

step1 RETURNED WITHOUT ERROR   (now rejected at the runtime bounds/
                               type check BEFORE the write)
step2 RETURNED WITHOUT PANIC   (was: fatal trap)
guest healthy afterwards

Bad behavior gone; legal legacy config (irq<16 LEGACY maps) unaffected (bounds check uses ICU_HWI_VECTORS=16, type check passes for LEGACY).

Kernel references

• sys/platform/pc64/icu/icu_abi.c:373-376 (KKASSERT-only bounds + type)
• sys/platform/pc64/icu/icu_abi.c:379 (im_flags OOB RMW write — the faulting insn)
• sys/platform/pc64/icu/icu_abi.c:389,396 (im_trig write, elcr_write_trigger)
• sys/platform/pc64/icu/elcr.c:70-92 (KASSERT-only irq guard, 1<<irq UB)
• sys/sys/systm.h:94-122 (asserts compiled out without INVARIANTS)
• sys/sys/machintr.h:103 (bus_config_intr → legacy_intr_config shim)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.