DF-5555 — usb_template_audio.c CDC-renumber misfire census (pass 2)

File: sys/bus/u4b/template/usb_template_audio.c (396 LOC) Class: structural harness, same evidence family as DF-5553 (usb_template_phone.c). Deterministic, no guest state required beyond a compiler.

What this proves

The template core's usb_make_raw_desc() (sys/bus/u4b/template/usb_template.c:135-146,162-171) classifies CDC union / call-management descriptors only by (bLength >= 5, type == 0x24, subtype in {6, 1}). USB-Audio CS_INTERFACE descriptors share type 0x24 with those subtypes, so the heuristic fires on this template's tables too. Census (9 hits):

Two real corruptions of generated descriptors (in-bounds; offset 4 < bLength 7), seven zero-delta misclassifications. No memory unsafety.

Build

cd findings/poc/DF-5555
./build.sh          # or: scp to the guest and run there (see VERDICT.md)

build.sh sed-extracts the audited file's body VERBATIM from the guest's /usr/src (sha256 must equal the audit tree's dd3d65e17a662a75d02ffada2158c72aef47359cf1dd9a07c4f489ea9e26a535) into audio_body.inc and compiles table_check.c (which #includes it) twice: stock, and -DFIX_CLASSGATE (fix.diff's class gate).

Run

./run.sh            # baseline replay + S1-S8 + fix-logic check

Expected output (decisive lines)

  HIT    audio_raw_desc_20 ... in iface 1: CDC-CM patch byte[4] (bDelay) delta=+1  <-- REAL DELTA
  HIT    audio_raw_desc_30 ... in iface 2: CDC-CM patch byte[4] (bDelay) delta=+2  <-- REAL DELTA
  MISFIRE ... byte[4] (bDelay) 0x03 -> 0x04  <-- CORRUPTED
  MISFIRE ... byte[4] (bDelay) 0x01 -> 0x03  <-- CORRUPTED
  -> census: 9 descriptor(s) satisfy the CDC predicate; 2 in nonzero interfaces ...
  ALL STRUCTURAL CHECKS PASSED
  MISFIRE lines under FIX_CLASSGATE: 0 (expected 0)

Exit 0; run.log and run.2.log are byte-identical (deterministic).

Everything else the template-family checklist hunts is verified negative by the same binary: S1 bLength==sizeof on all 22 raw tables, S2 all 9 pointer tables NULL-terminated without holes, S3 string descriptors self-sized, S4 full 0..255 string-index sweep clean, S5 no vendor/HID surface, S6 AC-header interface hardcodes match the numbering walk (bInCollection=2, baInterfaceNr={1,2}, wTotalLength=169 exact), S7 speed tables in-bounds/fail-closed, S8 audio-graph IDs all resolve.

DF-5555 — VERDICT

Finding: usb_make_raw_desc()'s CDC renumbering heuristic misclassifies the audio template's USB-Audio CS_INTERFACE descriptors; two AS_GENERAL bDelay bytes are corrupted in the generated config descriptor (iface 1: 0x03→0x04, iface 2: 0x01→0x03), and seven more descriptors in interface 0 sit on the predicate with zero delta today.

Verdict: reproduced (deterministic structural replay against the guest's own sha-verified source; same evidence class as DF-5553). Impact: none for privilege/memory safety — see "Impact ceiling".

1. Root cause (path:line)

• The core patcher discriminates CDC descriptors ONLY by generic shape: sys/bus/u4b/template/usb_template.c:135-137 (union: raw[0] >= 5 && raw[1] == UDESC_CS_INTERFACE(0x24) && raw[2] == UDESCSUB_CDC_UNION(6) → bytes 3,4 += temp->bInterfaceNumber) and usb_template.c:162-164 (call management: same with subtype UDESCSUB_CDC_CM(1) → byte 4 += bInterfaceNumber). Struct layouts: sys/bus/u4b/usb_cdc.h (usb_cdc_union_descriptor 5 bytes, usb_cdc_cm_descriptor 5 bytes, both __packed).
• USB Audio 1.0 class-specific descriptors ALSO use type 0x24 with subtypes that collide: AS_GENERAL = 0x01, FEATURE_UNIT = 0x06 (sys/bus/u4b/template/usb_template_audio.c:205-208,273-276,141-169).
• The interface numbering walk (usb_template.c:307-314 incrementing bInterfaceNumber seeded to 0xFF at usb_template.c:379) assigns: iface 0 = audio_iface_0 (AC, usb_template_audio.c:196), iface 1 = audio_iface_1_alt_0/1 (AS playback, :254/:263), iface 2 = audio_iface_2_alt_0/1 (AS record, :312/:321). Raw descs are scanned at usb_template.c:318-325 with the CURRENT interface number, endpoint raws at usb_template.c:209-215/:332-338.

2. Census (checklist item b) — what the harness proved

9 of the 22 raw tables satisfy the predicate:

The CS_ENDPOINT descriptors (audio_raw_desc_22 :216, audio_raw_desc_32 :284, type 0x25) and all type-II/format descriptors (subtype 2) never match — verified by scanning endpoint ppRawDesc tables with the same interface number, exactly as the core does (usb_template.c:209-215).

All writes land at offset 4 (or 3+4) with bLength >= 5 checked first, inside the heap config buffer the core just memcpy'd the table into — no OOB write is possible from this bug; the const source tables are never written. This is deterministic descriptor-semantics corruption, not memory corruption.

The seven interface-0 hits are the family's "rebase hazard": the bytes the heuristic would patch are bUnitID/bSourceID (feature units) and bcdADC-hi (AC header). In-tree they get +0 because the AudioControl interface is numbered 0, but any future nonzero-interface embedding of these tables (composite gadget, reordered config) silently corrupts the audio graph identity fields instead of a harmless hint byte.

3. Why "reproduced / impact none"

• The generated-vs-authored byte diff in run.log shows exactly two corrupted bytes, deterministic across runs (run.log == run.2.log).
• Activation of this template is privileged: USB_SET_TEMPLATE requires caps_priv_check_self(SYSCAP_NODRIVER) (sys/bus/u4b/usb_dev.c:1716-1721); the global usb_template default is set by the hw.usb.usb_template boot tunable / hw.usb.template sysctl (root; sys/bus/u4b/usb_device.c:112-119; guest default observed: 0 = MSC), and generation only runs on a gadget-side device attach (usb_device.c:1727 → usb_temp_setup_by_index, usb_template.c:1359-1361 — AUDIO, unlike PHONE, does have a case). The guest has no device-side USB controller, so no runtime EP0 path exists to observe; the structural replay against sha-identical source (dd3d65e1…, guest /usr/src == audit tree) is the honest maximum, per the family standard set by DF-5553.
• Corruption ceiling: a malformed bDelay hint (and under rebase, bUnitID/bSourceID/bcdADC) in descriptors presented to a USB HOST by a root-configured gadget. No unprivileged trigger, no kernel memory effect, no host-side parser in this tree consumes the bytes (the corruption is visible to whatever host the gadget is plugged into). Hence Info severity, impact=none — identical classification to DF-5553.

4. Everything else the family checklist hunts — verified negative

Proven by the same binary (run.log, all PASS):

• (a) Descriptor tables: S1 — bLength == sizeof(table) for all 22 raw tables (the memcpy at usb_template.c:131 cannot over-read); S2 — all 9 pointer tables (audio_raw_iface_0/1/2_desc, audio_raw_ep_1/2_desc, audio_iface_1/2_ep, audio_interfaces, audio_configs) are NULL-terminated with no interior hole.
• (c) String tables: S3 — all five string descriptors self-sized and even; S4 — full 0..255 index sweep of audio_get_string_desc() (usb_template_audio.c:375-396): non-NULL exactly for index 0 (any lang) and 1..4 @ 0x0409, NULL otherwise — bounded by string_index < INDEX_AUDIO_MAX (:392), no OOB, designated initializers cover all 5 slots (:378-384), iInterface/iConfiguration indexes all in-range.
• (d) Vendor/HID + iface hardcodes: S5 — usb_template_audio sets no getVendorDesc (:354-366); the core short-circuits to NULL (usb_template.c:1050-1060), so there is no vendor/HID length contract to violate. S6 — interface numbers hardcoded inside raw descriptors match the numbering walk: AC header bInCollection=2 == AS interface count, baInterfaceNr={1,2} == walk output (:96-99, confirmed by S6 checks), and wTotalLength 0x00a9 == exact sum (169) of the 16 AC-interface descriptor lengths. S8 — every bSourceID/mixer/selector pin in the AC interface resolves to a defined unit/terminal ID.
• (e) Speed tables: S7 — audio_isoc_mps.mps[]/ audio_isoc_interval.bInterval[] indexed only with USB_SPEED_FULL/USB_SPEED_HIGH (< USB_SPEED_MAX, in-bounds; usb_template_audio.c:231-239); other speeds read 0 → the core fails closed with USB_ERR_INVAL (usb_template.c:221-229).
• No dynamic state, locks, refcounts, or copyin/copyout exist in this file (const tables + one pure callback) — the race/refcount/leak classes are structurally N/A; the EP0 length clamp (usb_handle_request.c:744-748, cited in DF-5553) covers the readback side for the whole family.

5. Fix and validation

fix.diff is the family fix authored in DF-5553 and re-validated here at table level: thread the containing interface's bInterfaceClass into usb_make_raw_desc() and gate the CDC union/CM renumbering on UICLASS_CDC/UICLASS_CDC_DATA interfaces. The -DFIX_CLASSGATE binary (identical harness with the gate compiled in) drops the misfires from 9 (two with nonzero bDelay deltas) to 0 while all S1-S8 checks still pass — with the gate, the audio template's generated descriptors equal the authored bytes by construction.

A kernel-level A/B build is not_testable for the same reason as DF-5553: observing the generated bytes at runtime requires a device-side USB controller that this guest (and no in-tree default config) provides, plus root to select the template; there is no observable kernel behavior to compare. The logic-level validation is complete and deterministic.

6. Artifacts

• table_check.c — harness (verbatim body include + predicate/numbering replay + S1-S8). sha256 4d7cf91d169e6b5fd2b2bbc04538dfaa94fb88eac4841f882f00a73f2b78680e
• audio_body.inc — 339 lines extracted from the guest's /usr/src/sys/bus/u4b/template/usb_template_audio.c (sha256 of source dd3d65e1… == audit tree)
• build.log, run.log, run.2.log, env.txt — full untrimmed guest output; run.log == run.2.log
• fix.diff — family class-gate fix (core-side)
• manifest.json, verdict.json

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.