DF-5744 — apple_gmux: missing I/O-region length validation → out-of-bounds port I/O

What

sys/gnu/dev/misc/apple_gmux/apple-gmux.c attach never validates the size of the I/O resource it gets from the ACPI _CRS. GMUX_MIN_IO_LEN is defined at apple-gmux.c:77 and never referenced — the upstream Linux v4.8 driver this was ported from (drivers/platform/x86/apple-gmux.c) has

if (gmux_data->iolen < GMUX_MIN_IO_LEN) { ... ret = -ENODEV; goto err_release; }

but the DragonFly port dropped it. On x86, bus_read_1/bus_write_1 on an IOPORT resource are raw inb/outb with no bounds checking, so with a short _CRS the production driver performs reads/writes to I/O ports far outside its rman allocation: version regs at offsets 0x04–0x06, and (when those read 0xff) the indexed probe gmux_is_indexed() writes 0xaa/0x55/0x00 to offsets 0xcc–0xce and the indexed protocol touches 0xc2–0xc5, 0xd0, 0xd4.

Precondition: an ACPI gmux device (APP000B) whose _CRS window is smaller than the registers the driver touches — i.e. crafted/malicious firmware, a root-modified DSDT override, or a firmware bug. (Requires no Apple hardware: the driver is a loadable KLD that will happily probe any APP000B device.)

Rig

• ssdt_a.aml (generated by make_ssdt.py): one device \_SB.ZZZ0, _HID "APP000B", _CRS = 4 ports at 0x333.
• gmuxobs.c → gmuxobs.ko: canary module watching the 16550 COM1 scratch register at port 0x3ff — fully readable/writable, zero functional side effects. 0x333 + 0xcc = 0x3ff, so gmux_is_indexed()'s first indexed probe write lands exactly on the canary.

Build / run (guest, root)

cd /root/gmuxobs_a && make                          # gmuxobs.ko
# boot QEMU with: -acpitable file=ssdt_a.aml
kldload /root/gmuxobs_a/gmuxobs.ko                  # baseline: hw.gmuxobs_scr: 0
kldload apple_gmux                                  # PRODUCTION module
sysctl hw.gmuxobs_scr                               # expect 0xaa == 170

Expected result (observed 2026-10-11, DragonFly 6.5-DEVELOPMENT X86_64_GENERIC)

apple_gmux0: <apple gmux controller> port 0x333-0x336 on acpi0   <- 4-port resource
apple_gmux: gmux device not present or IO disabled
device_probe_and_attach: apple_gmux0 attach returned -19
hw.gmuxobs_scr: 170                                               <- 0xaa canary hit

The production driver wrote 0xaa to port 0x3ff — 204 bytes past the end of its 4-port allocation — corrupting an unrelated device's register (here the UART SCR; on real hardware whatever lives near the gmux window: PIC ELCR, PM registers, SMBus, ...). Also 3 OOB reads at 0x337–0x339 (offsets 4–6 vs size 4) before the indexed probe.

Fix validation (same rig, patched module from fix.diff)

apple_gmux: gmux I/O region too small (4 bytes, need >= 120)
device_probe_and_attach: apple_gmux0 attach returned -19
hw.gmuxobs_scr: 0        <- canary untouched

Files

• make_ssdt.py — SSDT generator (hand-encoded AML)
• ssdt_a.aml — the planted table
• gmuxobs.c / Makefile — canary observer KLD
• run.log — decisive run (full console capture)
• dmesg.txt — full dmesg of the rig boot
• fix.diff — 2 hunks: size validation (classic + indexed-probe minimum)
• fix_validation.log — patched-module run on the same rig

DF-5744 VERDICT — REPRODUCED (production code, on-guest)

Status: reproduced · impact: dos-class hardware-state corruption (OOB port I/O) · confidence: certain

Root cause (static, certain)

• sys/gnu/dev/misc/apple_gmux/apple-gmux.c:737-744 — bus_alloc_resource_any for SYS_RES_IOPORT with no size check; return value NULL-checked only.
• apple-gmux.c:77 — GMUX_MIN_IO_LEN defined, dead (never referenced in the file; upstream Linux v4.8 apple-gmux.c uses it in exactly the check the port dropped).
• Consumers of offsets beyond any validated bound:
• gmux_pio_read8 at 0x04–0x06 during attach (apple-gmux.c:758-760)
• gmux_is_indexed() writes 0xcc/0xcd/0xce (apple-gmux.c:351-353)
• indexed protocol: 0xc2–0xc5 (VALUE, incl. bus_read_4), 0xd0 (READ), 0xd4 (WRITE) (apple-gmux.c:216-303)
• x86 bus_space I/O ops are raw inb/outb — no rman bounds enforcement.

Reproduction (guest: DragonFly 6.5-DEVELOPMENT, X86_64_GENERIC, QEMU i440fx)

Planted SSDT with \_SB.ZZZ0 { _HID "APP000B", _CRS = IO 4 ports @ 0x333 } (QEMU -acpitable), COM1 SCR (port 0x3ff) as a side-effect-free canary — 0x333+0xcc = 0x3ff exactly.

Observed (run.log):

1. apple_gmux0: port 0x333-0x336 on acpi0 — 4-port resource granted.
2. Baseline canary: hw.gmuxobs_scr: 0.
3. kldload apple_gmux (unmodified shipped /boot/kernel/apple_gmux.ko).
4. Canary after: hw.gmuxobs_scr: 170 (0xaa) — the exact byte gmux_is_indexed() writes to bus_write_1(sc->io_res, 0xcc, 0xaa) (apple-gmux.c:351), landing 0xcc bytes past the end of the 4-port allocation, in another device's register.
5. Attach then failed -ENODEV ("gmux device not present") — the OOB accesses are on the failure path by design of the port: they happen before the driver gives up.

This is production code writing to hardware registers of unrelated devices outside its allocated I/O window. On the rig the victim is a UART scratch byte (chosen to be harmless); on real hardware the adjacent window can hold PIC ELCR, PM logic, embedded controller or SMBus registers — corruption there is at minimum a hang/panic (dos), potentially worse (e.g. toggling power rails via EC registers).

Threat model

Reachability requires an APP000B ACPI device with an undersized _CRS: malicious/crafted firmware (supplier compromise, evil DMA... not realistic for remote), or root-performed ACPI table override + kldload (already privileged), or a benign firmware bug (real: Linux added the length check because such machines existed). Not reachable by an unprivileged local user. Hence Low severity despite the clean OOB-write primitive: it is a robustness/divergence defect whose trigger is privileged input, consistent with the audit's treatment of crafted-firmware preconditions.

Fix validation

fix.diff (2 hunks): reject regions < GMUX_MIN_IO_LEN at attach, and reject regions < GMUX_PORT_WRITE+4 before the indexed probe (the probe runs before classic/indexed is known, and touches up to 0xd4).

Patched module (module-only rebuild of the same source), identical rig:

apple_gmux: gmux I/O region too small (4 bytes, need >= 120)
device_probe_and_attach: apple_gmux0 attach returned -19
hw.gmuxobs_scr: 0        <- canary untouched, no OOB access

Baseline bug reproduced / patched behavior gone ⇒ fix_status: fixed.

Notes / divergence

• Upstream Linux v4.8 checks iolen < GMUX_MIN_IO_LEN (0x78) only; the indexed probe's 0xcc–0xd4 overreach beyond 0x78 exists upstream too — but upstream never drops the check. DragonFly's port is strictly more permissive; the port owner (DragonFly) should restore the check and extend it to the indexed ports.
• Rig construction notes in make_ssdt.py (hand-encoded AML; small I/O descriptor 0x47 carries byte-sized align/len — verified against QEMU's own DSDT; EndTag checksum byte must be 0x00).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.