DF-5530 — VERDICT

Status: reproduced (panic, both sinks) — production-shape race + deterministic sink.

Environment

DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026, X86_64_GENERIC, pseudo-device bpf compiled in (kernel, not KLD), xhci.ko/ehci.ko loaded, QEMU -device qemu-xhci so usbus0 exists. Rigs are KLDs built against the guest's /usr/src/sys.

How it was reproduced

Sink 1 — usb_pf.c:191 (ubus->ifp = NULL, ubus from ifp->if_softc == NULL)

usbpf_race.c drives the two production code paths against each other on the live bus:

• creator thread: if_clone_create("usbus0", …) / if_clone_destroy("usbus0") — exactly the SIOCIFCREATE path (net/if.c:2005-2013 → if_clone.c:74-95 → usbpf_clone_create);
• detacher thread: unlocked read of ubus->ifp (the same read usbpf_detach() performs at usb_pf.c:209) and, whenever the published ifnet has not set IFF_UP yet (usb_pf.c:170 — strictly inside the usb_pf.c:157→177 window), calls the production usbpf_detach(ubus) (usb_controller.c:240's entry point, usb_pf.c:207).

The detacher's filter keeps it out of the known DF-2347/DF-2607 double-destroy interleaving (striking a completed clone); with the filter, every strike lands on a half-built ifnet. Result — twice, on two independent boots, < 45 s each (panic.txt, panic_race.txt):

Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0x5c8
fault code             = supervisor write data, page not present
instruction pointer    = 0x8:0xffffffff80a50a9f
Stopped at usbpf_clone_destroy+0xf:  movq $0,0x5c8(%rax)

0x5c8 is offsetof(struct usb_bus, ifp); the faulting store is ubus->ifp = NULL (usb_pf.c:191) with ubus == ifp->if_softc == NULL — i.e. the strike landed between the publish at usb_pf.c:157 and the ifp->if_softc = ubus assignment at usb_pf.c:164.

Sink 2 — net/bpf.c:1574 (bp->bif_ifp with bp == NULL)

bpfdetach_null.c constructs exactly the state usbpf_clone_destroy() sees when the strike lands between usb_pf.c:164 and :177 (ifnet named, if_softc set, not yet bpf-attached): if_alloc(IFT_USB) + ksnprintf(if_xname) + production bpfdetach(ifp). Result (panic_sink.txt):

DF5530: calling bpfdetach() on not-bpf-attached usbus0 ...
Fatal user address access from kernel mode from kldload ...
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0x20
instruction pointer    = 0x8:0xffffffff802aac53
Stopped at bpfdetach.cold.7:  movq 0x20,%rax

0x20 is offsetof(struct bpf_if, bif_ifp); bp is NULL because the search loop (bpf.c:1567-1571) legitimately found no match and the "Interface wasn't attached" guard tests bp->bif_ifp == NULL instead of bp == NULL.

Why this is not the known findings

DF-1100, DF-2347 and DF-2607 all race usbpf_xfertap (the tap hooks) against clone teardown. DF-5530's race is create vs destroy (usbpf_clone_create vs usbpf_detach/usbpf_clone_destroy), no tap involved, with two distinct NULL-deref sinks, one of which (the bpfdetach typo) is a latent defect in net/bpf.c reachable by this file's destroy path.

Threat model

Both race endpoints are privileged: clone creation is SIOCIFCREATE (caps_priv_check(SYSCAP_RESTRICTEDROOT), net/if.c:2005-2013); the detach side is controller detach (kldunload / devd) or SYSUNINIT shutdown. A root user racing ifconfig usbus0 create against kldunload xhci (or unplug-driven detach on hotplug-capable hardware) gets a deterministic kernel panic — local DoS, no memory-safety impact demonstrated (both faults are NULL derefs of small offsets). Severity Medium per the rubric ("local DoS … requires unusual privilege").

Fix validation

fix.diff (usb_pf.c: publish-after-init + NULL-softc guard; bpf.c: bp == NULL typo) applied to a clean-source guest, kernel rebuilt with make nativekernel, installed, rebooted:

• kldload bpfdetach_null.ko → loads cleanly, prints bpfdetach: usbus0 was not attached, no panic;
• kldload df5530_race.ko → runs its full 240 s window with the same strike filter, no panic (RACE_RESULT=NOHIT).

See fix_build.log, fix_run.log.

Attempts

1. race v1 (no strike filter) — guest died <30 s at usbpf_clone_destroy+0xf (same sink 1 signature; coarse detacher).
2. race v2 (ifunit-based filter) — harness artifact: ifunit() panics without ifnet_lock ("panic: ifnet is not locked"); filter replaced with the IFF_UP check, no production code involved in this artifact.
3. race v3 (IFF_UP filter) — sink 1 reproduced (<45 s), panic.txt.
4. sink module — sink 2 reproduced deterministically, panic_sink.txt.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.