DF-5525 — iicsmb_intr panics the kernel on any iicbus event outside

iicsmb_intr() (sys/bus/iicbus/iicsmb.c:242-243) ends its event switch with panic("%s: unknown event (%d)!", __func__, event). Events are plain ints produced by controller drivers through iicbus_intr() (iiconf.c:45-51, the path every pcf-style ISR takes); any future or third-party controller that reports a status code outside INTR_GENERAL..INTR_NOACK (0x1..0x7) takes the whole system down instead of being logged and dropped.

Files

df5521_rig.c shared rig; hw.dfa.fire_event=N injects iicbus_intr(iicbus0, N, &c) exactly like a controller ISR (only while the bus owner is set, i.e. mid-transaction) df5521_poc.c fireevent mode: child holds SMB_BREAD in flight while the parent fires event 153 (0x99) panic.txt baseline: panic: iicsmb_intr: unknown event (153)! with the full backtrace through iicbus_intr -> sys___sysctl run.fixed.log patched: kprintf + continue, guest alive fix.diff panic -> kprintf+break

Reproduce

chain up (load_chain.sh); sysctl hw.dfa.rdelay=300; /root/df5521_poc fireevent # baseline: panic -> db> (serial console)

DF-5525 VERDICT — REPRODUCED (kernel panic from a controller-supplied event value; hardening fix validated)

The bug

iicsmb_intr() handles INTR_GENERAL/START/STOP/RECEIVE/TRANSMIT/NOACK/ ERROR and then (sys/bus/iicbus/iicsmb.c:242-243):

default:
    panic("%s: unknown event (%d)!", __func__, event);

The event is an unvalidated int produced by whatever controller driver sits under the iicbus and is delivered through the production interrupt path (iicbus_intr() → IICBUS_INTR(sc->owner), iiconf.c:45-51). iicbus_if.m defines no contract that pins producers to {1..7}; a controller bug (or a new event added to one driver but not the bridge — exactly how INTR_NOACK-style additions happen) turns one stray status code into a full system panic. Fault isolation, not attacker-reachable data: severity Info.

Verification

Baseline (stock modules, production chain up, owner held by an in-flight SMB_BREAD): firing iicbus_intr(iicbus0, 153, &c) — the same call pcfintr makes on 8 paths — produced:

panic: iicsmb_intr: unknown event (153)!
iicsmb_intr() at iicsmb_intr+0x67
dfa_fire_event_sysctl() at ...
sysctl_root ... userland_sysctl ... sys___sysctl
Debugger("panic")  → db>

Fixed (panic → kprintf + break): iicsmb_intr: unknown event (153)! is logged, iicbus_intr returned (no fault), the in-flight transaction completes, /dev/smb0 remains, guest alive.

Fix

fix.diff: log-and-continue. (An upstream-grade alternative is KASSERT under DEBUG discipline; the kprintf preserves diagnosability without the system-down failure mode.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.