DF-5486 — if_cue.c attach-failure DF-5334-class panic (goto-detach-on-unattached)

What

cue_attach() (sys/bus/u4b/net/if_cue.c) routes its device-controlled failure branch through cue_detach() on a usb_ether that was never attached — identical class to DF-5334 (if_cdce.c), DF-5384 (if_aue.c), DF-5395 (if_axge.c), DF-5397 (if_urndis.c), DF-5399 (if_mos.c), DF-5411 (if_udav.c), DF-5453 (if_kue.c), all proved on this guest:

• usbd_transfer_setup() fails (no bulk-in/bulk-out endpoints on an otherwise matching CATC device) → if_cue.c:407-410 goto detach → if_cue.c:425-426 cue_detach(dev).
• At that point ue->ue_lock, ue_dev, ue_udev, ue_methods, ue_tq are ALL still zero — they are assigned only at if_cue.c:412-416, after the failing call (lockinit(&sc->sc_lock,...) at :402 is the only softc initialization before it).
• cue_detach() (if_cue.c:437) calls uether_ifdetach(ue) (usb_ethernet.c:267-305): usb_proc_drain() is a no-op on the zeroed ue_tq (usb_process.c:409); uether_getifp() returns the embedded arpcom ifnet (never NULL — the if (ifp != NULL) guard at :278 is dead code); then usb_ethernet.c:281 UE_LOCK(ue) = lockmgr(NULL, LK_EXCLUSIVE) → Fatal trap 12, fault VA 0x0.

The second failure branch (uether_ifattach() error, if_cue.c:418-422, only reachable on usb_proc_create() ENOMEM) has the same shape and additionally reaches ether_ifdetach() on a never-if_attach()ed ifnet → ifindex2ifnet[0] nulling + global ifnet list corruption.

Threat model: attacker-supplied USB device (evil adapter / evil dock / VM USB attach) presenting one of the 3 VID:PID pairs in cue_devs[] (CATC NETMATE 0x042e:0x5600, NETMATE2 0x042e:0x5601, SmartBridges SMARTLINK 0x087d:0x5600) at config 0 / iface 0 without the expected bulk-in + bulk-out endpoints. Not remotely triggerable, not an unprivileged-local program — physical/VM USB access. (Softc is zeroed by newbus — subr_bus.c:1953 M_ZERO — so the fault address is fixed at 0, not attacker-influenced.)

Reproduce (evidence class: KLD harness driving production code)

QEMU cannot emulate a CATC USB-EL1210A. The harness cue_attach_poc.c replays cue_detach() verbatim (its two production calls, in order) on the exact state cue_attach()'s failure branch produces, using the production usbd_transfer_unsetup() and uether_ifdetach() (exported by uether.ko). The only non-production code is the static cue_attach/cue_detach frame itself (they are static in if_cue.c and only reachable via goto detach with a physical CATC present).

# build (in guest, pack synced to /root/df5486)
cd /root/df5486 && make -m /usr/src/share/mk

# run (auto-loads STOCK /boot/kernel/uether.ko as dependency)
kldload -v ./cue_poc.ko
# expected: 3 marker lines, then
#   Fatal trap 12: page fault while in kernel mode
#   fault virtual address = 0x0
#   Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi
#   (guest dead in DDB)

Fix validation

fix.diff (git-apply-able against clean sys/, git apply --check OK): (a) class-wide guard in uether_ifdetach() — early return when ue->ue_lock == NULL; (b) cue_attach() routes both pre-attach failure branches to a local detach_usb: label doing only usbd_transfer_unsetup() + lockuninit() (fixes the branch-2 ether_ifdetach-on-unattached corruption too).

Applied to the guest's /usr/src (patch(1) Plan A, all hunks), both modules rebuilt -Werror clean, patched uether.ko installed: the identical harness run prints cue_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, dmesg | grep -c 'Fatal trap' = 0, clean kldunload, and the patched if_cue.ko driver loads/unloads clean. See run.log vs panic.txt.

Files

• cue_attach_poc.c + Makefile — the harness
• build.log — harness build (full, -Werror)
• fix_uether_build.log / fix_if_cue_build.log — patched module builds
• panic.txt — baseline serial record (stock modules)
• run.log — patched run (survival proof) + dmesg markers
• env.txt — guest uname, kldstat, dmesg tail, compiler
• fix.diff — the fix (never applied to the audit tree)
• VERDICT.md, manifest.json, verdict.json

VERDICT — DF-5486 (if_cue.c goto-detach-on-unattached panic)

status: reproduced / impact: panic / confidence: certain

Root cause (line-accurate)

sys/bus/u4b/net/if_cue.c:

• :402 lockinit(&sc->sc_lock, ...) — the ONLY softc initialization done before the failing call.
• :405-410 usbd_transfer_setup(...); on error → goto detach.
• :412-416 ue->ue_sc/ue_dev/ue_udev/ue_lock/ue_methods assigned — AFTER the failing call, so all still NULL/zero on the failure branch.
• :418-422 second branch: uether_ifattach(ue) error → goto detach.
• :425-427 detach: cue_detach(dev); return (ENXIO);
• :436-437 cue_detach() runs usbd_transfer_unsetup() (safe on the zeroed xfer array) then uether_ifdetach(ue).

sys/bus/u4b/net/usb_ethernet.c:

• :273 usb_proc_drain(&ue->ue_tq) — no-op on the zeroed ue_tq (sys/bus/u4b/usb_process.c:409 returns when up->up_lock == NULL).
• :276 ifp = uether_getifp(ue) = &ue->ue_arpcom.ac_if (:133-137) — embedded member, NEVER NULL.
• :278 if (ifp != NULL) — dead guard, always true.
• :281 UE_LOCK(ue) = lockmgr(ue->ue_lock=NULL, LK_EXCLUSIVE) (:61) → Fatal trap 12, fault VA 0x0.

Softc is zeroed by newbus (sys/kern/subr_bus.c:1953, kmalloc(..., M_INTWAIT | M_ZERO)), so the fault address is fixed 0 — a fixed-address NULL deref, not attacker-influenced memory corruption.

Branch 2 (uether_ifattach error — only usb_proc_create() ENOMEM, usb_ethernet.c:173-178): ue_lock IS set, so uether_ifdetach proceeds to ether_ifdetach() (:294) on an ifnet that was never if_attach()ed (ue_attach_post_task never ran — it is queued only AFTER successful usb_proc_create, :181-185) → sysctl_ctx_free() on a never-initialized ctx (:297), devfs_clone_bitmap_put() of a unit never allocated (:300), and ether_ifdetach tearing down a zeroed ifnet (ifindex/ifnet-list corruption — same latent shape as DF-5334/5384).

Reachability (attacker model)

cue_probe() (:374-386) matches ANY of the 3 cue_devs[] VID:PIDs (CATC NETMATE 0x042e:0x5600, NETMATE2 0x042e:0x5601, SmartBridges SMARTLINK 0x087d:0x5600) at config index 0 / iface 0. cue_config (:133-153) then requires UE_BULK endpoints in both directions (UE_ADDR_ANY). A device presenting a matching VID:PID but with no bulk endpoints (or descriptors that fail endpoint lookup) makes usbd_transfer_setup() return an error → branch 1 → deterministic panic at plug-in. Evil-USB-adapter / evil-dock / VM-attach scenario; not remote, not unprivileged-local-software. if_cue.ko is in the default module set (built by sys/bus/u4b/net/cue/Makefile, present as /boot/kernel/if_cue.ko on the stock guest) and auto-loads on device-match by uhub.

Evidence

• panic.txt (baseline, stock modules): the 3 cue_poc: markers, then Fatal trap 12: page fault while in kernel mode, fault virtual address = 0x0, current process = 1075 (kldload), Stopped at lockmgr_exclusive+0x5d: orl (%r14),%esi, db> — guest dead.
• Harness (cue_attach_poc.c) replays cue_detach() verbatim — its two production calls in order — on the exact branch-1 state (zeroed cue_softc, sc_lock lockinit'd, everything else NULL), using the PRODUCTION usbd_transfer_unsetup() + uether_ifdetach() from the stock auto-loaded uether.ko. QEMU cannot emulate a CATC USB-EL1210A, and cue_attach/cue_detach are static, so state+call-sequence replay is the strongest runnable evidence for this class (same evidence class as DF-5334/5384/5395/5397/5399/5411/5453).
• run.log (patched): identical harness under the fix → all 4 markers including cue_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, clean kldunload, dmesg | grep -c 'Fatal trap' = 0 (checked twice), and the patched if_cue.ko driver module loads/unloads clean.
• build.log, fix_uether_build.log, fix_if_cue_build.log: -Werror clean builds of harness, patched uether.ko, patched if_cue.ko.

Why not higher severity

Fixed-address NULL deref (softc zeroed by newbus) at USB plug time; no attacker-controlled data reaches the fault. Impact = local DoS requiring physical/VM USB access — same tier as the 7 siblings (Medium, AV:P). No path to uid0 from this primitive.

Fix validated

fix.diff: (a) cue_attach() routes both pre-attach failures to a new detach_usb: label doing only usbd_transfer_unsetup() + lockuninit(); (b) class-wide belt-and-braces guard in uether_ifdetach() (if (ue->ue_lock == NULL) return;). Applied in-guest via patch -p1 (all hunks, Plan A), both modules rebuilt -Werror clean, patched uether.ko installed to /boot/kernel, the IDENTICAL harness re-run → SURVIVED, RC=0, 0 traps, clean unload; patched driver module loads/unloads. git apply --check passes against the clean read-only sys/ tree.

Pass-2 negative results (USB-net family checklist, all killed)

• (a) RX callback (cue_bulk_read_callback, :443-490): gate actlen <= 2+sizeof(struct ether_header) at :459 drops runts; the device-supplied 16-bit frame length is clamped len = min(actlen - 2, len) at :466-467; uether_rxbuf (usb_ethernet.c:589) independently rejects len < ETHER_HDR_LEN || len > MCLBYTES - ETHER_ALIGN and copies into a fresh MCLBYTES cluster; 2 + len <= actlen <= bufsize = MCLBYTES + 2 (:149) → bounded, no OOB. Single frame per transfer (AOP_RXCOMBINE deliberately not set, :615-616) → no multi-frame m_adj accounting exists.
• (b) TX (cue_bulk_write_callback, :492-551): m_pkthdr.len clamped to MCLBYTES (:513-514), frame_len = len+2 ≤ MCLBYTES+2 = bufsize exactly (:139, :515); usbd_m_copy_in at offset 2 (:524) → exact fit. pkthdr.len desync from the mbuf chain (dead code at default if_mtu 1500) is benign for usbd_m_copy_in and BPF. No double-free; error path requeues via tr_setup.
• (c) Register helpers (:194-271): all fixed-length ≤8-byte stack buffers; cue_getmac fills ue_eaddr[ETHER_ADDR_LEN] exactly (usb_ethernet.h:107); cue_csr_read_2's uninitialized val on request failure only feeds a collisions counter (:561-563) — no secret is returned to userspace. cue_init PAR0-i loop (:598-599) stays within 0x62-0x67, no register-index underflow.
• (e) No m_adj/m_copyback/if_output in cue at all; the only device-fed lengths are the bounded 2-byte rx header and the 6-byte MAC.
• Known pass-1 findings NOT re-reported: DF-1081 / DF-2339 (cue_setmulti 8-byte hashtbl for the 64-byte 512-bit hash, :311/:329/:338 — 9-bit index OOB stack write).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.