DF-5466 VERDICT — reproduced (negative boot tunable → negative vectors → exception-gate smash → triple fault), Low severity

Bottom line

REPRODUCED on the production-behaviour kernel (X86_64_NOINV), and — unlike DF-5464/DF-5465 — no INVARIANTS KASSERT guards this path at all, so every kernel config is equally affected. hw.icu.msi_start is parsed by icu_abi_initmap() (icu_abi.c:323-324) with kgetenv_int → strtoq (accepts '-'), masked with signed ~0x1f (-32), and never range-checked. icu_abi_initmap() runs unconditionally at boot (machdep.c:2785), so a single hw.icu.msi_start="-32" in /boot/loader.conf poisons every later ICU MSI allocation:

• the scan loop runs with i = -32 (icu_abi.c:473); on cpu1 the window icu_irqmaps[1][-32..-1] aliases the previous row's tail [0][160..191] (all UNUSED), so the "free window" check passes;
• OOB writes im_type=MSI, im_msi_base=-32 into cpu0's row (icu_abi.c:495-496) and intrs[j] = -32+j (icu_abi.c:498);
• msi_setup(-32..-1, 1) (icu_abi.c:499) reads msi_intr[-32..-1] OOB (msi.c:433-435 — the 192-entry table lives in .rodata at 0xffffffff80d9d800, so the "handlers" are rodata garbage) and calls setidt(0x20-32+j = 0..31, garbage, ..., cpu1) — overwriting cpu1's exception gates 0..31 (#DE/#PF/#GP/#BP/...).

The rig then pinned itself to cpu1 and executed int $3: the serial console shows icu_msi_start: on cpu1, triggering int3 ... followed immediately by the bootloader menu with zero trap text — #BP (gate 3, garbage RIP) → instruction-fetch #PF (gate 14, garbage) → #DF (gate 8, garbage) → triple fault → cold reset. The machine rebooted by itself (fresh dmesg, module gone).

This is the icu twin of DF-1037 (hw.ioapic.msi_start, ioapic_abi.c:753, Info, pass-1, unverified); this pack verifies the class end-to-end.

How it was reproduced (boot-config variant, run.log + panic_triplefault.txt)

# /boot/loader.conf: hw.icu.msi_start="-32"   (kenv confirms -32)
kldload icu_msi_start.ko
icu_msi_start: rc=0 zone[0]=-32 zone[31]=-1        <- NEGATIVE vectors
icu_msi_start: NEGATIVE vectors allocated ... gates 0..31 of cpu1 smashed
icu_msi_start: on cpu1, triggering int3 ...
<serial: next line is the boot loader menu — triple fault, no dump>

Primitive characterization

The poisoned tunable turns msi_setup() into an arbitrary-offset IDT gate writer (gates 0..31 of any online cpu, offsets read from OOB rodata before msi_intr[]) and the map writes corrupt the previous cpu's MSI bookkeeping. On a real ICU-ABI machine (no IOAPIC) the first PCI MSI allocation at boot hits this with no KLD involved. Trigger needs root (loader.conf / kenv) — hence Low severity despite the hard memory corruption + control-flow redirection.

Fix validation (fix.diff, applied to guest /usr/src, incremental rebuild)

Same boot config on the fixed kernel — knob still "-32" in /boot/loader.conf (kenv verified at runtime):

icu_msi_start: rc=0 zone[0]=32 zone[31]=63
icu_msi_start: allocation not OOB ... -- no gate smash, exiting cleanly

initmap clamps the poisoned start into range; allocation lands at the legal window 32..63; no OOB, no smash, guest healthy in the same boot.

Kernel references

• sys/platform/pc64/icu/icu_abi.c:323-324 (unvalidated tunable parse/mask)
• sys/platform/pc64/icu/icu_abi.c:167 ("for testing only" comment)
• sys/platform/pc64/icu/icu_abi.c:473-499 (negative-i scan, OOB writes, msi_setup)
• sys/platform/pc64/x86_64/machdep.c:2785 (initmap runs on every kernel)
• sys/platform/pc64/x86_64/msi.c:431-436 (msi_intr[intr] + setidt, no bounds)
• sys/kern/kern_environment.c:379-388 (kgetenv_int → strtoq, '-' accepted)
• findings/DF-1037 (ioapic twin, pass 1)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.