DF-5585 — pccard_cis_quirks fast path trusts stale pf/absent pf_last state: write-after-free / NULL-page write landmines (latent; unreachable with the shipped table)

File: sys/bus/pccard/pccard_cis_quirks.c (pass 2, GLM 5.3). Full narrative: VERDICT.md.

Reproduce (deterministic userland rig of the verbatim kernel loop)

./build.sh                          # cc -O2 -Wall -o poc_quirkfastpath poc_quirkfastpath.c
./run.sh                            # ./poc_quirkfastpath all

Expected decisive output (see run.log; exit 1 because findings>0): FREED-WRITE[repeat]: block ... (kmalloc #9) modified: first diff at +41 ... RESULT: DF-5585 repeat: quirk#3 fast path (pf_last==q->pf) STAILQ_INSERT_TAIL'd a cfe into the pf kfree'd at pccard_cis_quirks.c:282 -> write-after-free child died on SIGSEGV writing near address 0x28/0x30 ... RESULT: DF-5585 nulltemplate: NULL pf template + pf_last(NULL)==q->pf fast path -> &pf->cfe_head deref at offset 40 of NULL RESULT: DF-5585 matchmatrix: shipped table fast-path reachable by ANY card identity: NO Built and executed on the DragonFly guest (DragonFly 6.5-DEVELOPMENT x86_64, cc 8.3). The guest has no PCMCIA bridge (see env.txt), so the kernel path itself is not enterable; the rig embeds byte-identical copies of pccard_cis_quirk_match() (:201-216) and pccard_check_cis_quirks() (:218-292) — fidelity.diff shows the only differences are the 3 documented shim substitutions — plus a failpoint allocator that snapshots blocks at kfree time (kernel kfree does not scrub).

Scenarios: negative (clean install), shippedfail (shipped-table shape + cfe-alloc failure -> CLEAN: today's kernel is safe), repeat (write-after-free), fixed_repeat (fix.diff guard -> CLEAN), nulltemplate (NULL-page write, SIGSEGV child), fixed_nulltemplate (guard -> CLEAN), matchmatrix (machine-checked proof that NO card identity the shipped 8-entry table can match ever takes the fast path).

What it proves: the fast path if (pf_last == q->pf) at :263 dereferences pf under an invariant ("pf is the live copy built for template pf_last") that the cfe-allocation error path at :280-285 breaks by kfree'ing pf without invalidating it, and that a NULL q->pf entry breaks by matching pf_last == NULL == q->pf right after the wipe loop (which always exits with pf == NULL, :248-257). Unreachable with the shipped quirk table (every card's match set is <= 2 entries with distinct templates — proven by the matchmatrix); one table edit (a repeated/alternating template, exactly how :179-186 already shares templates across product ids) plus one M_NOWAIT failure during card insertion turns it into kernel heap corruption.

Recommended fix (fix.diff, validated in-rig by the fixed_* scenarios): NULL-guard table entries + reset pf_last on the :281-285 error path.

DF-5585 — VERDICT

Finding: pccard_check_cis_quirks() fast path (if (pf_last == q->pf), sys/bus/pccard/pccard_cis_quirks.c:263-270) dereferences pf under an invariant the function's own error paths do not maintain. Two latent facets:

1. Write-after-free — In the else-branch, when the cfe kmalloc(M_NOWAIT) fails (pccard_cis_quirks.c:280-285), the freshly allocated pf is kfreed (line 282) but the local pf keeps pointing at it and pf_last still names the previous successful template. If any LATER matching quirk re-uses that template (pf_last == q->pf true), the fast path runs STAILQ_INSERT_TAIL(&pf->cfe_head, ...) (line 270) into the freed pf — an 8-byte pointer write at offsetof(struct pccard_function, cfe_head) (=40 on amd64) plus a second write at +48, both attacker-influenced only in the sense that a quirk-table maintainer chooses the table; the trigger conditions are (a) one failed allocation during card insertion and (b) a table containing a repeated/alternating template among the entries one card can match.

2. NULL-page write — The wipe loop (pccard_cis_quirks.c:248-257) always exits with pf == NULL (pf is the loop variable; its exit condition is pf != NULL failing). If a table entry has q->pf == NULL and it is the first match, pf_last == NULL == q->pf takes the fast path and line 270 computes &((struct pccard_function *)NULL)->cfe_head = address 0x28, writing through stqh_last at 0x30 — a deterministic kernel panic (NULL page is unmapped in the kernel), and a NULL-deref write landmine.

Reachability today (the honest gate): NOT reachable. The quirk match (pccard_cis_quirks.c:201-216) requires (manufacturer, product) equality (three 3COM pairs, each contributing a func0/func1 entry pair) or INVALID/INVALID plus cis1_info[0]/[1] string equality (SVEC vs NDC strings differ — pccarddevs:327,332). Therefore every card identity's match set is at most 2 entries whose templates always differ, consecutive matches never share a template, the fast path is DEAD CODE for the shipped table, and a cfe-alloc failure can only strike the last matching entry. This is machine-checked by the rig's matchmatrix scenario over all 6 card identities. Additionally the whole path requires a physical PCMCIA card insertion (pccard.c:198, after pccard_read_cis), and this QEMU guest has no PCMCIA bridge, so the kernel path was not enterable for testing. Reported Info / hardening (latent landmine): one future quirk-table edit — e.g. adding a second cfe or another product id re-using an existing template, the exact pattern lines 179-186 already use to share pccard_3cxem556_func0 across two product ids — converts facet 1 into kernel heap corruption reachable by card insertion under memory pressure.

Rig proof (what was actually run): poc_quirkfastpath.c embeds byte-identical copies of pccard_cis_quirk_match() and pccard_check_cis_quirks() (fidelity.diff: only the 3 documented shim substitutions — device_t dev→sc parameter, dropped PCCARD_SOFTC line, qlog in the dead bootverbose block). The rig's allocator snapshots every block at kfree time (kernel kfree does not scrub memory) and audits freed blocks for post-free modification.

• shippedfail (shipped-table shape, cfe alloc of quirk#2 fails at the failpoint): CLEAN — negative control proving the shipped kernel is safe under this failure.
• repeat (3-entry table re-using the func0 template; same failpoint): FREED-WRITE detected — block from kmalloc call #9 (the pf freed at :282) modified at +41 (the stored cfe pointer lands at cfe_head.stqh_first, offset 40..47), i.e. STAILQ_INSERT_TAIL wrote into freed memory. Exit 1.
• nulltemplate (pf==NULL entry after a non-empty wipe): child process died on SIGSEGV writing near 0x28/0x30 — the userland image of the kernel NULL-page write.
• fixed_repeat / fixed_nulltemplate (verbatim copy + fix.diff's two guards): CLEAN — both facets eliminated; the fixed run installs two function copies instead of corrupting freed memory.
• Deterministic: run.log and run.2.log identical.

Impact ceiling: none in the shipped kernel (dead code path); latent heap write-after-free / NULL-write one table-entry away. Threat actor for the live variant is whoever can insert a card whose CIS matches a quirk — physical access, same threat model as the DF-5355..5364 family.

Root cause lines: sys/bus/pccard/pccard_cis_quirks.c:263 (fast-path predicate trusts pf_last==q->pf ⇒ pf live), :270 (insert through pf), :280-285 (kfree of pf without invalidating the tracking state), :248-257 (wipe leaves pf == NULL while pf_last == NULL too).

Fix: fix.diff — (1) skip malformed entries (q->pf == NULL || q->cfe == NULL), (2) reset pf_last = NULL on the :281-285 error path so the invariant "pf_last names the template of the live pf" always holds. Validated in-rig (fixed_* scenarios). Kernel-rebuild fix validation was not performed: the bug is unreachable in the shipped kernel, so there is no baseline kernel behavior to reproduce/eliminate (fix_status: not_testable).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.