DF-5578 — ufm(4): ufm_do_req() reads uninitialized stack buf[0] into

*retbuf before the error check — latent DF-1062-class disclosure,

CONTAINED on the current stack (Info)

Production file: sys/bus/u4b/misc/ufm.c (Cypress CY7C68xxx FM radio, /dev/ufm*). Evidence class: KLD-harness-with-production-code + synthetic usbd request capture (family standard, DF-5455): no Cypress 0x04b4:0x1002 radio exists on the QEMU guest, so the verbatim production driver is compiled into a KLD and its EP0 transport is rerouted to a capture shim reproducing the traced usbd_do_request_flags() completion semantics.

What the code does

ufm_do_req() (ufm.c:176-200):

uint8_t buf[1];                              /* 183: UNINITIALIZED      */
USETW(req.wLength, 1);                       /* 189                     */
error = usbd_do_request(sc->sc_udev, NULL, &req, buf);   /* 191        */
if (retbuf) { *retbuf = buf[0]; }            /* 193-194: BEFORE the
                                                error check            */
if (error) { return (ENXIO); }               /* 196-198                 */

buf[0] is loaded and stored to *retbuf even when the request failed — on every timeout/short/stall the caller's byte receives stale kernel stack. Two callers then matter: ufm_get_stat() copies ret into the FM_GET_STAT ioctl word (ufm.c:292 → copyout at sys_generic.c:730), and ufm_start() branches on it (ufm.c:257).

Why it is contained today (and the one-flag counterfactual)

ufm uses the plain usbd_do_request macro = usbd_do_request_flags( udev, mtx, req, data, 0 /* flags */, NULL /* actlen */, …) (usbdi.h:511-512). With flags=0 and the default EP0 template carrying no short-ok flags (usb_transfer.c:76-88), a short control-IN DATA stage completes with USB_ERR_SHORT_XFER (usb_transfer.c:2979-2985) — an error — so ufm_do_req returns ENXIO and both callers discard ret (ufm.c:253-256, 288-291). err==0 without the 1-byte copy-out is provably impossible: success requires actlen == sumlen (usb_transfer.c:2952+), actlen sums completed frames (usb_transfer.c:2936-2940), so a full 1-byte DATA stage was DMA'd and copied (usb_request.c:680-681).

The counterfactual (harness mode 3) is exactly the DF-1062 delta: with USB_SHORT_XFER_OK (uchcom.c:398) or via usbd_do_request_proc with actlen == NULL (usb_serial.h:220 — the stack's zero-pad-on-short only exists behind a non-NULL actlen, usb_request.c:782-787), the same call site returns err==0 with nothing copied and FM_GET_STAT hands one stale kernel-stack byte to the ioctl caller. The finding is filed so a one-flag drift (or a caller that starts logging ret on error) does not silently turn ufm into DF-1062/#5455.

Exposure ceiling even in the counterfactual: /dev/ufm* is created 0644 root:operator (ufm.c:153) and ufm_ioctl requires O_RDWR (ufm.c:304-306), so the only default opener is root — matching the Info severity.

Build

sh build.sh    # in-tree kmod build on the guest:
               # /usr/src/sys/bus/u4b/misc/df5578 + make
               # (guarded copy ufm_prod_guarded.c = production ufm.c
               #  sha256 845738f2... + ONE guard hunk, prod_guard.diff)

Run

sh run.sh      # kldload ufmunleak.ko x3, kldunload, dmesg | grep UFM5578

Expected (decisive) output

UFM5578: gate fflags=FREAD        : rc=13 (EACCES) out=0x12345678
UFM5578: FULL FM_GET_STAT short   : rc=5 (EIO) out=0x000000cc -- LEAK BLOCKED (discarded)
UFM5578: FULL FM_GET_STAT silent  : rc=5 (EIO) out=0x000000cc -- LEAK BLOCKED (discarded)
UFM5578: FULL FM_GET_STAT full    : rc=0 out=0x0000005c -- device byte delivered
UFM5578: FULL FM_GET_STAT shortok : rc=0 out=0x.. -- STALE STACK BYTE REACHES IOCTL CALLER
UFM5578: calibrate: poison depth 1 MATCHES buf[0] slot
UFM5578: pat=0xff rep=0 mode=short-ok   : PROD ret=0xff MATCH          (18/18 total)
UFM5578: pat=0xff rep=0 FIXED(buf={0}) : ret=0x00 (clean)              (18/18 total)
UFM5578: RESULT: counterfactual short-ok: 18/18 pattern-match; fixed twin clean 18/18

plus the request capture (EP0 composition audit):

SET_FREQ 100700000 Hz -> SET_FREQ bReq=1 wVal=0x0022 wIdx=0x22d0 ; CMD0 bReq=0 wVal=0x0096 wIdx=0x00b7 (bm=0xc0 wLen=1)
SET_FREQ 2147483647 Hz -> ... wVal=0xfd64 wIdx=0x6442   (signed-overflow wrap, device-bound only)
FM_START rc=0: [0] bReq=0 0x0000/0x00c7  [1] bReq=2 0x0001/0x0000
FM_STOP  rc=0: [0] bReq=0 0x0016/0x001c  [1] bReq=2 0x0000/0x0000

Fix

fix.diff — initialize the buffer (uint8_t buf[1] = {0};, one line, same shape as the DF-5455 umoscom fix). Validated: in-harness fixed twin under identical poisoning returns 0x00 in every mode (18/18), and the patched production ufm.ko builds -Werror-clean (fix_build.log, rc=0).

DF-5578 VERDICT — reproduced (latent pattern + containment + counterfactual + fix); Info severity; impact none on the current stack

Executive summary

sys/bus/u4b/misc/ufm.c ufm_do_req() (ufm.c:176-200) declares uint8_t buf[1] uninitialized, hands it to a 1-byte EP0 vendor control-IN (UT_READ_VENDOR_DEVICE, wLength=1, ufm.c:185-191) and then executes *retbuf = buf[0] (ufm.c:193-194) before the error check — so on every failed/short request the caller's byte receives stale kernel stack. ufm_get_stat() (ufm.c:277-295) copies that byte into the FM_GET_STAT ioctl word (ufm.c:292) that the generic ioctl layer copyouts to userspace (sys/kern/sys_generic.c:730).

On the current stack this never reaches userspace — the plain usbd_do_request macro passes flags=0 (no USB_SHORT_XFER_OK, sys/bus/u4b/usbdi.h:511-512), the shared default EP0 transfer template carries no short-ok flags (sys/bus/u4b/usb_transfer.c:76-88), so a short DATA stage completes with USB_ERR_SHORT_XFER (sys/bus/u4b/usb_transfer.c:2979-2985) which ufm_do_req maps to ENXIO, and both callers return EIO discarding the byte (ufm.c:253-256, 288-291). err==0 without the copy-out is provably impossible: success requires actlen == sumlen (usb_transfer.c:2952+), actlen is summed over completed frames (usb_transfer.c:2936-2940), and only then is the byte DMA'd+copied (usb_request.c:680-681). The hr_func shortcut (usb_request.c:477-523) is unreachable for a real host-mode device (usbd_get_hr_func returns NULL, usb_request.c:335-345; ufm's probe requires USB_MODE_HOST, ufm.c:123-124).

Why file it anyway (Info): this is exactly the delta that separated DF-5448/5438/5489 (no consumer — Info) from DF-1062/DF-5455 (real leak): the sibling uchcom driver makes the SAME 1-byte vendor read with USB_SHORT_XFER_OK (uchcom.c:398) and usbd_do_request_proc with actlen == NULL (usb_serial.h:220) — one flag of drift in ufm (or a caller that starts using ret on the error path, or the driver being copied as a template) and FM_GET_STAT becomes a 1-byte-per-call kernel stack disclosure. Additionally the exposure is bounded: /dev/ufm* is 0644 root:operator (ufm.c:153) and ufm_ioctl requires O_RDWR (ufm.c:304-306) — root-only by default.

What ran (KLD harness with production code, DF-5455 family standard)

• ufm5578_harness.c #includes ufm_prod_guarded.c — a byte-identical copy of the guest's /usr/src/sys/bus/u4b/misc/ufm.c (sha256 845738f2..., == the audited tree) plus ONE guard hunk (prod_guard.diff): the usbd_do_request macro is rerouted after its usbdi.h definition to the separate-TU shim ufm_shim_request() (ufm5578_shim.c), mirroring production's opaque cross-module call (same-TU inlining let GCC fold the provably-uninitialized load in the DF-5455 incident — run.1.fold.log there).
• The real ufm_ioctl() is driven through a fabricated struct usb_fifo (public, usb_dev.h:102; usb_fifo_softc() just returns priv_sc0, usb_dev.c:2499-2502); ufm_do_req() / ufm_get_stat() etc. are the verbatim statics, reachable because the production .c is compiled into the TU. DRIVER_MODULE(ufm, uhub, ...) stays registered and inert (no Cypress radio on the guest; ufm is not in X86_64_GENERIC and not kldloaded).
• Shim modes reproduce the traced completion semantics of usbd_do_request_flags() for this 1-byte control-IN: mode 0 = short ZLP DATA stage → USB_ERR_SHORT_XFER (error); mode 1 = silence → USB_ERR_TIMEOUT (error); mode 2 = full 1-byte DATA stage → success + 1 byte copied; mode 3 = counterfactual short-ok success (what USB_SHORT_XFER_OK or usbd_do_request_proc-with-NULL-actlen yields) → success, buffer untouched. Every call also captures the request tuple.
• Deterministic stale-stack stand-in: recursive 256-byte poison frames; matching depth calibrated at load (depth 1).

Results (3 loads, deterministic)

Why not higher severity / no uid0 chain

• No user-visible manifestation on the current stack (proven above and at runtime: modes 0/1 → EIO + discarded byte).
• Even the counterfactual leak is 1 stale byte per FM_GET_STAT, gated behind an O_RDWR open of a 0644 root:operator node → root only by default. No corruption primitive, no write path, nothing to groom.
• This is not a memory-corruption finding; no kernel rebuild/reboot validation required. Fix validated at module level (family standard: in-harness fixed twin + patched module compile).

Pass-2 negative results (checked and killed, with path:line)

• DF-1062-family short-control-IN leak: contained — full proof above (flags=0 macro usbdi.h:511-512; template usb_transfer.c:76-88; SHORT_XFER usb_transfer.c:2979-2985; discard ufm.c:253-256/288-291; hr_func unreachable usb_request.c:335-345).
• DF-5320-family open/close/detach races: ufm defines no f_open/f_close (dummies installed, usb_dev.c:1824-1828); in-flight ioctls hold a fifo refcount (usb_dev.c:1094, 279-286) and usb_fifo_detach → usb_fifo_free drains on cv_drain (usb_dev.c:593-618) before ufm_detach returns to lockuninit (ufm.c:169-171) and softc free; stale-fd ioctls after detach fail in usb_ref_device (udev->fifo[] NULLed under usb_ref_lock, usb_dev.c:582-591, 251-254 → ENXIO). No UAF window.
• ioctl buffer handling: _IOWR('U',20x,int) → 4-byte kernel buffer copyin/copyout by sys_generic.c:668-730; no usermem deref in the driver.
• privilege gates: O_RDWR requirement ufm.c:304-306 present and correct; node perms ufm.c:153.
• freq math: (freq + 10700001) signed-overflow UB for root-supplied extremes (runtime-captured wVal=0xfd64/wIdx=0x6442) — garbage to the device only; no kernel memory effect.
• attach error path: usb_fifo_attach NULLs f_sc->fp[] first (usb_dev.c:1869-1870), usb_fifo_free(NULL) is safe (usb_dev.c:571-574), usb_destroy_dev(NULL) is safe (usb_device.c:2025-2026).
• names/locking: ksnprintf bounded (ufm.c:143-144); sc_lock only held transiently for sc_freq get/set (ufm.c:214-216, 238-240); no lock-order inversion with the drain path (usb_dev.c:596-607 drops usb_ref_lock before taking priv_lock).
• radio-state lifecycle: newbus zeroed softc → sc_freq starts 0; get/set guarded; GET returns last SET exactly (captured).

Fix

fix.diff (one line, DF-5455 shape): uint8_t buf[1] = {0}; in ufm_do_req(). Also worth considering: move *retbuf = buf[0] under !error — the value is meaningless on failure.

Guest state: dirtied by the harness dirs (/usr/src/sys/bus/u4b/misc/ df5578{,_fix}, /root/df5578, kldload/kldunload x3); reset via vm.sh reset with-src after evidence collection — next spawn starts clean.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.