Summary

'char data' is written only by the INTR_TRANSMIT callback, but iicbus_intr writes *buf only via the current bus owner and both in-tree owners are no-ops for INTR_TRANSMIT - PCF_SET_S0 clocks the uninitialized stack byte to the external master. One byte of kernel stack to a hardware observer; latent behind DF-5490 (the NULL deref fires first). init-to-zero fix.

PoC verification

Evidence pack

findings/poc/DF-5491 · 4 files

File	Type	Size
README.md	—	1.0 KB	↓ raw
verdict.json	—	2.5 KB	view raw
env.txt	—	350 B	view raw
manifest.json	—	531 B	view raw

README.md

↓ download raw

DF-5491 — pcfintr slave-transmitter sends an uninitialized kernel stack byte onto the I2C wire

char data in pcfintr (pcf.c:396) is only initialized by the INTR_TRANSMIT callback path. iicbus_intr() (iiconf.c:50-51) writes *buf only through the current bus owner's INTR method; with no owner it writes nothing, and both in-tree owners are no-ops for INTR_TRANSMIT (/dev/iic: iicbus_generic_intr, iic.c:78; iicsmb: case just breaks, iicsmb.c:225-227). The byte is then transmitted to the external master: PCF_SET_S0(pcf, data) at pcf.c:437 and pcf.c:456.

Impact: 1 byte of kernel stack disclosed to a hardware observer (external I2C master that addresses the local slave address in read direction). Hardware-gated (PCF8584 silicon required) and latent behind DF-5490 (the iicbus_intr call panics on the NULL softc before the byte is sent).

Fix: char data = 0; (or have iicbus_intr define *buf when no handler).

No PoC (Phase V skipped per contract for Info hardware-gated hardening). Source-verified only. See verdict.json.

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

per-fix-DF-5491

Detail

Evidence (decisive lines)

source analysis only: pcf.c:396 (char data uninitialized), pcf.c:434-437 and 452-456 (PCF_SET_S0(pcf, data) after callbacks that do not write *buf), iiconf.c:50-51 (only writes via sc->owner's INTR method), iic.c:78 (generic no-op), iicsmb.c:225-227 (INTR_TRANSMIT no-op)

Verified recommended fix

initialize 'char data = 0' in pcfintr (pcf.c:396) or have iicbus_intr() write a defined value (e.g. 0xFF/NACK) into *buf when there is no owner / no handler.

Verdict

UNTESTED (hardware-gated; latent behind DF-5490 until it is fixed): in pcfintr's slave-transmitter paths, 'char data' (pcf.c:396) is stack-uninitialized and is only written by the INTR_TRANSMIT callback (iicbus_intr, iiconf.c:50-51) -- which never writes it when no bus owner exists (owner==NULL: no write) and is a no-op for the two in-tree owners that can hold the bus (/dev/iic registers iicbus_generic_intr, iic.c:78; iicsmb_intr's INTR_TRANSMIT case just breaks, iicsmb.c:225-227). pcf then transmits that uninitialized stack byte on the I2C wire: PCF_SET_S0(pcf, data) at pcf.c:437 and pcf.c:456. A hardware observer (external I2C master addressing the pcf's own slave address) receives 1 byte of leaked kernel stack. Cannot be exercised live: QEMU has no PCF8584 model, and today the call never completes because iicbus_intr() dereferences the never-attached iicbus child's NULL softc first (DF-5490 panic). One byte to a hardware observer, no userland readback path found.

pcfintr slave-transmitter paths transmit an uninitialized kernel stack byte onto the I2C wire (callbacks never fill *buf)