DF-5745 — apple_gmux: dual-instance attach clobbers the shared global softc pointer → NULL-deref panic in vga_switcheroo dispatch

What

apple_gmux_softc_data is a single static global (apple-gmux.c:130). In apple_gmux_attach:

• line 867: apple_gmux_softc_data = sc; — unconditional, even for a second gmux ACPI device;
• lines 880-884: vga_switcheroo_register_handler() fails with -EINVAL for the second instance (a handler is already registered, sys/dev/video/vga/vga_switcheroo.c:242-245);
• line 894 (error path): apple_gmux_softc_data = NULL; — also unconditional.

Net state after the second (failed) attach: the first instance's handler is still registered, but the global it dispatches through is NULL. Every vga_switcheroo dispatch then executes

gmux_switchto():  apple_gmux_softc_data->switch_state_ddc = id;   /* :511 */
gmux_switch_ddc(): ...->switch_state_ddc                          /* :524 */
gmux_set_power_state(): gmux_set_discrete_state(apple_gmux_softc_data, ...) /* :581 */

→ write to NULL+offset → fatal page fault.

Natural trigger on affected systems: i915 load (sys/dev/drm/i915/i915_drv.c:742 — if (vga_switcheroo_handler_flags() & VGA_SWITCHEROO_CAN_SWITCH_DDC) vga_switcheroo_force_migd(); → vgasr_priv->handler->switchto with no NULL guard, vga_switcheroo.c:1225-1239). Also /dev/vga_switcheroo writes (root-only, 0600) and any DRM EDID probe via vga_switcheroo_lock_ddc.

Precondition: two ACPI devices with _HID APP000B (crafted DSDT/SSDT, or duplicated gmux entries from a firmware bug).

Rig

• ssdt_b.aml: AAA0 @ 0x8e + AAA2 @ 0x4cc, 4-port _CRS each (both reach full attach: version reads at base+4 hit readable QEMU ports 0x92 / ELCR 0x4d0-0x4d1, so the classic path is taken).
• ssdt_b2.aml: same two devices with valid-length 0x78-port regions (AAA0 @ 0x4cc, AAA2 @ 0x8e) — proves the bug is independent of the DF-5744 length issue.
• gmuxtrig.c → gmuxtrig.ko: calls the same production entry point i915 uses at boot: vga_switcheroo_force_migd().

Build / run (guest, root)

cd /root/gmuxtrig_b && make
# boot QEMU with: -acpitable file=ssdt_b.aml
kldload apple_gmux                       # AAA0 attaches; AAA2 fails at -22
kldload /root/gmuxtrig_b/gmuxtrig.ko     # -> panic

Expected result (observed twice: 4-port rig and 0x78-length rig)

apple_gmux: Failed to register vga_switcheroo handler
device_probe_and_attach: apple_gmux1 attach returned -22
gmuxtrig: vga_switcheroo handler_flags = 0x1 (CAN_SWITCH_DDC=1)
gmuxtrig: calling vga_switcheroo_force_migd() ...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x60
fault code = supervisor write data, page not present
Stopped at gmux_switchto+0x10: movl %edi,0x60(%rbx)      ; rbx == NULL global

Offset 0x60 == offsetof(struct apple_gmux_softc, switch_state_ddc) — the exact store at apple-gmux.c:511.

Fix validation (fix.diff, module-only rebuild)

• Guard gmux_switchto/gmux_switch_ddc/gmux_set_power_state against a NULL global (panic → -ENODEV).
• Clear the global on error/detach only when this softc owns it.
• Take ownership of the global only when it is still NULL (line 867).

Same 0x78-length rig, patched module, same trigger:

gmuxtrig: force_migd returned 0, NO PANIC     # dispatch drives the surviving instance

(Intermediate fix without the ownership hunk: returned -19, NO PANIC — no crash but dead handler; the ownership hunk restores function.)

Files

• make_ssdt.py (shared), ssdt_b.aml, ssdt_b2.aml
• gmuxtrig.c / Makefile — trigger KLD
• panic.txt, panic.b2.txt — panic signatures (both rigs)
• run.log — decisive run transcript
• fix.diff — 6 hunks; fix_validation.log — baseline/patched comparison

DF-5745 VERDICT — REPRODUCED (fatal page fault, production code, on-guest)

Status: reproduced · impact: panic (kernel NULL-deref DoS) · confidence: certain

Root cause (static, certain)

• apple-gmux.c:130 — single static apple_gmux_softc_data.
• apple-gmux.c:867 — unconditional apple_gmux_softc_data = sc; on every attach that reaches the registration stage.
• apple-gmux.c:880-888 — second instance's vga_switcheroo_register_handler() returns -EINVAL (vga_switcheroo.c:242-245: one handler per system).
• apple-gmux.c:892-894 — err_register_handler: path sets apple_gmux_softc_data = NULL unconditionally — destroying the live global owned by the first, still-attached instance.
• Dispatches dereference the global with no NULL guard: gmux_switchto apple-gmux.c:511-513, gmux_switch_ddc :524/530/533, gmux_set_power_state :581.
• Natural trigger: i915 boot path i915_drv.c:738-746 (handler_flags() & CAN_SWITCH_DDC → vga_switcheroo_force_migd() → handler->switchto() without checking the handler's softc); also root's /dev/vga_switcheroo (0600) writes and DRM EDID paths via vga_switcheroo_lock_ddc.

Reproduction (guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC, QEMU)

Planted SSDT with two APP000B devices. Two independent rigs:

1. 4-port _CRS rig (ssdt_b.aml, AAA0@0x8e, AAA2@0x4cc): both attach to the registration stage (version reads at base+4 hit readable QEMU ports 0x92 and ELCR 0x4d0/0x4d1 → "classic"); AAA0 registers the handler fully; AAA2 fails at -22 after overwriting + NULLing the global.
2. 0x78-length _CRS rig (ssdt_b2.aml) — same state machine with valid-length regions, proving independence from DF-5744.

Both rigs, unmodified shipped /boot/kernel/apple_gmux.ko, trigger KLD invoking the exact production entry point i915 uses:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x60        <- offsetof(switch_state_ddc)
fault code = supervisor write data, page not present
Stopped at gmux_switchto+0x10: movl %edi,0x60(%rbx)   <- rbx = NULL global

(panic.txt / panic.b2.txt; ssh session died + guest in DDB, vm.sh status ⇒ down — reproduced/panic per the status table.)

handler_flags = 0x1 (CAN_SWITCH_DDC=1) confirms i915_drv.c:742 would take the same branch on this state, i.e. on an affected machine the panic occurs spontaneously at DRM load, no root action needed beyond module load order.

Threat model

Requires two APP000B ACPI devices — crafted/malicious DSDT/SSDT (root / firmware compromise / firmware bug). Not reachable by an unprivileged local user on properly-firmware'd hardware. Kernel NULL-deref → panic (DoS), not memory corruption with controlled data (write value is an enum at a fixed small offset; NULL page not mappable on x86-64 without... the write is to fixed VA 0x60, kernel-mode, non-present → always a trap). Low severity consistent with the crafted-firmware precondition; impact ceiling is reboot-panic of a machine at DRM load.

Fix validation (module-only rebuild, same 0x78 rig)

• Step 1 (guards + conditional clear only): trigger → force_migd returned -19, NO PANIC — crash eliminated, but line 867's unconditional set still let the second instance claim-then-clear the global (handler dead).
• Step 2 (complete fix.diff, adds ownership: set global only if NULL): trigger → force_migd returned 0, NO PANIC, guest stays up — the surviving instance keeps working.

Baseline reproduced; patched behavior: no panic and functional dispatch ⇒ fix_status: fixed. (Intermediate -19 result retained in fix_validation.log as evidence the guard alone is insufficient for correctness.)

Notes

• Same-family lifetime issue as DF-2228 (ACPI notify-handler UAF) exists on the attach-error path (err_enable_gpe: → AcpiRemoveNotifyHandler after AcpiEnableGpe failure, apple-gmux.c:897-900) — same root cause class (no-op AcpiOsWaitEventsComplete), not re-reported here.
• vga_switcheroo.c has its own adjacent issues (e.g. force_migd lacks a handler NULL check; negative errno returned from d_write) — different file, noted for a future pass, not part of this finding.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.