VERDICT — DF-5514 (if_ipheth.c goto-detach-on-unattached, 9th DF-5334 instance)

Status: reproduced (panic, deterministic) · fix validated (fixed)

What was claimed and what the code says

ipheth_attach() (sys/bus/u4b/net/if_ipheth.c:217-265) has four error branches that all goto detach; (:235, :241, :252, :258), and the detach: label (:262-263) calls the full ipheth_detach(dev) — which calls uether_ifdetach(&sc->sc_ue) (:276) — even when uether_ifattach(ue) (:255) was never reached or never succeeded.

• Branches 1-2 (usbd_set_alt_interface_index :231-236 fails; usbd_transfer_setup :237-242 fails): the ue->ue_sc/ue_dev/ue_udev/ue_lock/ue_methods assignments at :243-247 run only after both calls, so the embedded usb_ether is still entirely zeroed (newbus allocates the softc M_ZERO, sys/kern/subr_bus.c:1953).
• uether_ifdetach() (sys/bus/u4b/net/usb_ethernet.c:267-305) then:
• usb_proc_drain(&ue->ue_tq) (:273) — no-op, up->up_lock == NULL early-returns (sys/bus/u4b/usb_process.c:397-410);
• ifp = uether_getifp(ue) (:276) — returns &ue->ue_arpcom.ac_if (usb_ethernet.c:133-137), never NULL because the arpcom is embedded in the softc (usb_ethernet.h:80-84) — the if (ifp != NULL) guard at :278 is dead code;
• UE_LOCK(ue) (:281) → lockmgr(NULL, LK_EXCLUSIVE) → Fatal trap 12, fault VA 0x0.
• Branch 3 (ipheth_get_mac_addr :249-253 fails — device just STALLs the 0x00 GET_MACADDR vendor request): ue_lock is valid, but uether_ifattach() never ran, so ue_tq is still zeroed (drain no-op) and the code proceeds to ether_ifdetach(ifp) (:294) on the embedded ifnet that was never if_attach()ed — the DF-2341/DF-5493 latent corruption/panic path (ifindex2ifnet[0]/ifnet-list damage).
• Branch 4 (uether_ifattach :255-259 fails): the only failure mode is usb_proc_create() ENOMEM, whose error path self-frees the ue_tq (usb_process.c usb_proc_create → usb_proc_free), so the state is branch-3-like: valid ue_lock, zeroed tq, never-attached ifnet.

The trigger is fully device-controlled: ipheth_devs[] is a product-agnostic match (if_ipheth.c:174-177) — any USB device with vendor 0x05ac exposing interface class 0xff / subclass 0xfd / protocol 1. Branch 1 additionally needs only a STALLed SET_INTERFACE(alt=1) — trivial for evil-adapter/dock/VM firmware, no iPhone needed.

How it was verified (KLD-harness-with-production-code)

No QEMU iPhone model exists, and ipheth_attach/ipheth_detach are static (unreachable without a physical Apple device), so — exactly like the 8 sibling packs — the harness (ipheth_poc.c) reconstructs the branch-1 post-failure state (kmalloc(M_ZERO) softc, sc_iface_no = 0 per :225, lockinit(&sc->sc_lock, ...) per :229 — the only softc init before the failing call) and replays ipheth_detach() verbatim using only production code after the goto: usbd_transfer_unsetup(sc->sc_xfer, IPHETH_N_TRANSFER) (:274) and uether_ifdetach(&sc->sc_ue) (:276), linked from stock uether.ko.

Baseline (stock uether.ko, fresh guest)

kldload -v /root/df5514/ipheth_poc.ko → guest died in DDB, serial console (panic.txt):

ipheth_poc: state check: ue_lock=0 ue_dev=0 ue_udev=0 ue_tq.up_lock=0 (all must be 0/NULL)
ipheth_poc: entering ipheth_detach() replay: usbd_transfer_unsetup() + uether_ifdetach() (if_ipheth.c:274+276)
Fatal user address access from kernel mode from kldload at ffffffff80647bad
Fatal trap 12: page fault while in kernel mode
fault virtual address        = 0x0
Stopped at      lockmgr_exclusive+0x5d: orl     (%r14),%esi

Identical trap signature to all 8 siblings (lockmgr_exclusive+0x5d, VA 0x0). vm.sh status → down. The fault address is fixed 0 (NULL deref) — panic/DoS, not attacker-controlled-data corruption; no privilege-escalation path exists from this primitive (nothing is written before the fault), consistent with the class's Medium rating.

Fix validation (fix.diff)

1. vm.sh reset with-src (clean source + clean modules), apply fix.diff in-guest to /usr/src (both hunks, Plan A).
2. Rebuild uether.ko and if_ipheth.ko — both -Werror clean (fix_build.log).
3. Install patched uether.ko into /boot/kernel.
4. Re-run the byte-identical harness (md5 f27308481209578091ab79c853df1979): ipheth_poc: SURVIVED uether_ifdetach(), KLDLOAD_RC=0, kldunload clean, dmesg | grep -c "Fatal trap" = 0 (run.log).
5. Patched driver module if_ipheth.ko also loads/unloads clean (fix_smoke.log).

fix.diff = (a) class-wide core guard: uether_ifdetach() early-returns when ue->ue_lock == NULL (fixes branches 1-2 everywhere); (b) driver: all four pre-attach error branches route to a minimal detach_usb label doing only usbd_transfer_unsetup() + lockuninit() (required for branches 3-4, where ue_lock is already valid but the ifnet was never attached). git apply --check passes against the clean read-only sys/ tree.

Pass-2 negative space (everything else on the USB-net checklist, killed with proof)

• (a) RX callback / m_adj accounting (DF-5396 class) — BOUNDED. uether_newbuf() returns an MCLBYTES cluster mbuf and itself applies m_adj(ETHER_ALIGN) (usb_ethernet.c:549-560: m_data=cl+2, m_len=2046); ipheth adds a second m_adj(m, ETHER_ALIGN) at :511 (m_data=cl+4, m_len=2044 — matches FreeBSD verbatim, wastes 2 bytes, harmless). usbd_xfer_set_frame_data(xfer, 0, m->m_data, m->m_len) (:518) programs the HC DMA to ≤2044 bytes into [cl+4, cl+2048). At TRANSFERRED, len = usbd_xfer_frame_len() (:487) is the host-controller-clamped actual length ≤2044 — NOT a device-parsed header field like urndis's rm_datalen. Gate len < 14+2 frees (:489-493); m_adj(m, 2) (:495) → m_len=2042; uether_rxmbuf(ue, m, len-2) (:498) sets m_len=len-2 ≤ 2042 = remaining cluster capacity exactly — no OOB possible. aframes ≤ requested frames = 1 (IPHETH_RX_FRAMES_MAX=1), so no multi-frame accounting exists (KASSERT frindex < max_frame_count, usb_transfer.c:2148-2153). No mos-DF-5400-style actlen-vs-pktlen confusion: per-frame length is used, not whole-transfer actlen.
• (b) TX path — BOUNDED. m->m_pkthdr.len clamped to IPHETH_BUF_SIZE=1516 (:422-423); usbd_m_copy_in(pc, 0, m, 0, ≤1516) (:425) into frame slot x of capacity 1516 at offset x*1516 ≤ 10612 < bufsize 8*1516=12128 (:415-416); usbd_frame_zero(pc, len, 1516-len) stays in-slot (:430-431); x ≤ 8. Error path frees sc_tx_buf before tr_setup re-entry (:452, :457-461); CANCELLED path frees (:452, :539). No double-free, no leak.
• (c) register/carrier helpers — exact fit. ipheth_get_mac_addr: wLength=6 into sc_data[64] + 6-byte memcpy to ue_eaddr[6] (:187-201). ipheth_tick: wLength=64 == sizeof(sc_data) (:320, var.h:53,75). Note: sc_carrier_on (:328-329) is never read anywhere — carrier check is dead code, and a short control response would leave stale sc_data[0]; since the value is never consumed, no impact (Info, not filed).
• (d) attach/detach error paths — THE finding (above). Also checked: lockuninit after the panic point only; usb_proc_create failure self-frees (label-safe for branch 4); branch-3/4 ether_ifdetach-on-unattached = DF-2341/DF-5493 mechanism (core-owned).
• (e) device-supplied data feeding m_adj/m_copyback/if_output — none beyond the above. Device-fed inputs are only: the 6-byte MAC (spoofable like any USB NIC — functional), the carrier byte (dead), and the HC-bounded RX length. No RNDIS-style parsed headers exist in this driver. VLAN frames >1516 are silently truncated on TX (:422-423) — inherited verbatim from Linux/FreeBSD ipheth semantics (device protocol limit 1516), functional only, not filed.

Bottom line

ipheth_attach()'s four goto detach branches run the full ipheth_detach() → uether_ifdetach() on a usb_ether that was never attached: branches 1-2 fault at lockmgr(NULL) (Fatal trap 12, VA 0x0 — reproduced deterministically on the guest with a production-code KLD harness), branches 3-4 reach ether_ifdetach() on a never-attached ifnet. Fully triggerable by an evil USB adapter (any Apple VID + class ff/fd/1 interface) at plug-in. Fixed by the class-wide core guard + minimal detach_usb label; identical harness survives on the patched build. DoS/panic tier, matching the 8 siblings (Medium).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.