DF-5666 — bios_sigsearch(9) lacks parameter sanity checks (API robustness, Info)

File: sys/platform/pc64/x86_64/bios.c (94 LOC, pass 2 GLM 5.3) Severity: Info (hardening; no reachable impact with in-tree callers) Evidence class: guest-live introspection + code reading (per reservation DF-5666..DF-5678)

What this is

bios.c on pc64 provides exactly ONE live symbol: bios_sigsearch (bios.c:66-94) — a read-only scan of the 128 KB BIOS ROM window (physical 0xe0000-0xfffff, accessed via BIOS_PADDRTOVADDR(x) = x + KERNBASE, pc64/include/pc/bios.h:36). The bios16/bios32 trampoline machinery is explicitly absent (bios.c:30-34); guest nm /boot/kernel/kernel confirms only bios_sigsearch exists (ffffffff80c19220 T bios_sigsearch).

The hardening gap

The function validates only its start argument (bios.c:72-78, accepting [0xe0000, 0x100000] inclusive — start == 0x100000 degenerates to zero iterations, harmless). It performs no validation of siglen, paralen, sigofs:

• paralen == 0 → sp += paralen (bios.c:91) never advances → infinite kernel loop if no match exists.
• paralen < 0 → sp walks backwards out of the window, below KERNBASE+0xe0000; the loop condition (sp + sigofs + siglen) < end (bios.c:84) stays true while the pointer decreases → unbounded OOB read below the window until an unmapped kernel VA faults (panic).
• sigofs < 0 → bcmp(sp + sigofs, …) (bios.c:87) reads before the window.
• siglen <= 0 → degenerate bcmp (len 0 "matches" instantly — first paragraph returned).

Why this is Info and not higher

• Sole in-tree caller is ipmi_smbios.c:186: bios_sigsearch(SMBIOS_START, SMBIOS_SIG, SMBIOS_LEN, SMBIOS_STEP, SMBIOS_OFF) = (0xf0000, "_SM_", 4, 0x10, 0) — all compile-time constants (pc64/include/pc/bios.h:56-60). No user-controlled value reaches any argument, ever.
• Guest-verified reachability: ipmi(4) is NOT compiled into X86_64_GENERIC (0 matches in the config); it exists only as /boot/kernel/ipmi.ko and is not loaded on the audit guest → the function does not execute at all in the default configuration. Loading it requires root.
• The data scanned is firmware-written ROM (attacker model = hostile firmware = ring -2, out of scope); consequences of hostile SMBIOS tables in the downstream parser were already filed as DF-2107 (sys/dev/misc/ipmi/ipmi_smbios.c, Medium) — not this file's bug.

Reproduce the introspection (not a crash PoC)

Phase V crash PoC is skipped per contract for Info hardening findings — "triggering" the gap requires a root-loaded kernel module passing paralen=0, which is not a threat model (root can halt the box anyway). The reserved evidence class for this file is guest-live introspection:

# guest up (dfbsd-qemu/vm.sh status)
dfbsd-qemu/vm.sh run_root "$(cat introspect.sh)"

Expected decisive output (see introspection.log):

ffffffff80c19220 T bios_sigsearch          <- live symbol
ipmi NOT compiled into X86_64_GENERIC ...  <- never runs at boot
000159c0  5f 53 4d 5f 28 1f 02 08 ...      <- "_SM_" anchor at phys 0xf59c0

Fix

One entry guard in bios_sigsearch (see fix.diff); not applied to sys/ (read-only audit tree), not kernel-rebuild-validated (fix_status: not_testable — no triggerable behavior to A/B for an Info finding).

Artifacts

• introspect.sh + introspection.log — the full guest-live evidence
• env.txt — guest environment
• VERDICT.md — full narrative
• fix.diff — git-apply-able hardening guard
• manifest.json, verdict.json

DF-5666 — VERDICT

Status: untested (Phase V crash PoC skipped per contract for Info hardening findings; guest-live introspection performed instead — it is the evidence class reserved for this file) Reproduced: no (nothing user-reachable to reproduce) Impact: none Confidence: certain (about the facts: the gap exists; the reachability analysis is code- and guest-verified)

The four checklist questions, answered with evidence

(a) What does this file actually provide on pc64?

Exactly one function: bios_sigsearch (sys/platform/pc64/x86_64/bios.c:66-94). The file header states it outright: "We cannot make bios16 nor bios32 calls … However, searching for bios rom signatures can be useful" (bios.c:30-34). Guest proof (introspection.log):

ffffffff80c19220 T bios_sigsearch
(bios16/bios32: none)

The header (sys/platform/pc64/include/pc/bios.h:34-37) declares only bios_sigsearch plus the BIOS_PADDRTOVADDR/BIOS_VADDRTOPADDR KERNBASE-offset macros and SMBIOS constants/structs. There is no pc32 twin in this tree (sys/platform/ contains only pc64 and vkernel64).

(b) Who reaches it, and when?

One in-tree caller: sys/dev/misc/ipmi/ipmi_smbios.c:186, inside ipmi_smbios_probe(), reached from ipmi_smbios_identify() (ipmi_smbios.c:222-250, results cached via the ipmi_probed state machine) called by the ipmi(4) identify/probe routines: ipmi_isa.c:58, ipmi_pci.c:98, ipmi_smbus.c:60,81. Every argument is a compile-time constant from machine/pc/bios.h:56-60 (0xf0000, "_SM_", 4, 0x10, 0).

Guest proof: ipmi has 0 matches in /usr/src/sys/config/X86_64_GENERIC, kldstat -v shows it not loaded, /boot/kernel/ipmi.ko exists as a module only, and there is no /dev/ipmi*. So on a stock system the function never executes; when it does (root kldload ipmi or a custom kernel), it runs once per boot at driver-identify time with firmware data as its only input.

(c) Buffer math

• Loop bound (sp + sigofs + siglen) < end (bios.c:84) is strict — the last byte compared is at end-2, i.e. the scan stays in bounds and is in fact one byte more conservative than necessary (a signature ending exactly at 0x100000 would be missed; for SMBIOS this is physically moot since the 31-byte EPS cannot fit there). No OOB read on any in-tree path.
• start is validated to [0xe0000, 0x100000] (bios.c:72-78); start == 0 maps to BIOS_START; anything else returns 0. start == 0x100000 degenerates to zero iterations. Pointer range KERNBASE+0xe0000 .. KERNBASE+0x100000 — mapped (guest /dev/mem dump of the window succeeded and returned firmware bytes), return conversion BIOS_VADDRTOPADDR fits u_int32_t.
• The gap: siglen/paralen/sigofs are trusted ints. paralen==0 → infinite loop (bios.c:91); paralen<0 → backwards OOB walk below the window (bios.c:84 condition stays true as sp decreases); sigofs<0 → reads before the window (bios.c:87); siglen<=0 → degenerate bcmp match. No in-tree caller can pass such values — kernel-API hardening only.

(d) Boot-time attacker model

The scanned window is firmware-written (BIOS ROM / reserved area). Guest dump shows SeaBIOS's SMBIOS 2.8 EPS: _SM_ at physical 0xf59c0 (16-byte aligned), _DMI_ intermediate anchor, structure table at 0xf59e0, 10 structures — i.e., had ipmi.ko been loaded, bios_sigsearch would have matched at 0xf59c0 and handed that address to the downstream parser. A hostile firmware controlling that data is ring -2 compromise (out of model), and the downstream table-walk risk was already filed as DF-2107 against sys/dev/misc/ipmi/ipmi_smbios.c (Medium) in this audit — deliberately not re-filed here (different file, pass-2 discipline).

Why not a crash PoC

The only way to exercise the unvalidated-parameter paths is a kernel module calling bios_sigsearch(0xf0000, "_SM_", 4, 0, 0) — loading it requires root, and a root-triggerable kernel hang is not a vulnerability. Per contract, Info hardening findings skip Phase V; the guest-live introspection above is the verification for this file's reservation.

Fix validation

fix.diff adds an entry guard (sig==NULL / siglen<=0 / paralen<=0 / sigofs<0 → return 0). Not kernel-rebuild-tested: fix_status not_testable — there is no triggerable misbehavior on a stock guest to A/B against (the guard is pure defense-in-depth for future callers).

Bottom line

bios.c is a 94-line, correct-on-every-in-tree-path, boot-time, firmware-data-only signature scan. The sole reportable item is the missing API parameter validation — filed as Info hardening. Everything else considered (bounds math, entry validation, mapping, TOCTOU/locking — none applicable, no locks, boot-time identify only, caller caches results) is negative; see the JSON result block's negative_notes.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.