DF-5748 — VERDICT

Status: reproduced (rig, verbatim production code) · Impact: none (dead code / misleading lifetime guard) · Confidence: certain

What was run

KLD rig rfcomm_up5748.ko: verbatim rfcomm_session.c / rfcomm_dlc.c / rfcomm_upper.c (md5s in setup.log) + stub L2CAP; remote-peer TS 07.10 frames injected with valid FCS through the exact vector the real L2CAP layer uses (btproto->input). Trigger sysctl hw.df5748_fire=1:

1. rfcomm_attach/rfcomm_rcvd/rfcomm_connect two DLCs (channels 3, 4 → DLCI 6, 8) — one shared session, initiator;
2. L2CAP connected callback → SABM(0); injected UA(0) → session OPEN → production rfcomm_dlc_connect() sends PN for both DLCs;
3. injected PN responses (mtu 127, CFC) → production path sends SABM(dlci); injected UA(dlci) → production rfcomm_dlc_open() (MSC sent, state OPEN); injected MSC responses stop the mcc timers;
4. rfcomm_disconnect() both → state WAIT_DISCONNECT, DISC sent, 20 s ack timer armed by rfcomm_upper.c:252;
5. production rfcomm_dlc_close() on A (the exact call rfcomm_detach() makes at rfcomm_upper.c:278-279);
6. full production rfcomm_detach() on B;
7. 22 s sleep → session expiry callout fires → rfcomm_session_free().

Observed (baseline, run.log)

[DF-5748] dlc A state=6 (6=OPEN), dlc B state=6 (6=OPEN)
[DF-5748] disconnect(A) -> 0; state=7 (7=WAIT_DISCONNECT)
[DF-5748] disconnect(B) -> 0; state=7
[DF-5748] A timer: pending=1 active=1   (ARMED by rfcomm_disconnect:252)
[DF-5748] A after rfcomm_dlc_close(): pending=0 active=0
[DF-5748] DEAD: callout_active() == 0 after rfcomm_dlc_close(); the RFCOMM_DLC_DETACH branch at rfcomm_upper.c:293 is UNREACHABLE
[DF-5748] rfcomm_detach(B) returned; B freed via immediate kfree (DETACH flag never taken)
=== DF-5748 harness done (no crash) ===

The decisive chain of facts, all from production calls:

• rfcomm_disconnect() arms the DLC timer (pending=1 active=1) — so the callout machinery is live;
• rfcomm_dlc_close() — which rfcomm_detach() always runs first for a non-CLOSED DLC (rfcomm_upper.c:278-279) — leaves callout_active() == 0, because its callout_stop() (rfcomm_dlc.c:164) clears CALLOUT_ACTIVE unconditionally at entry (sys/kern/kern_timeout.c:869) and drains any in-progress callback (kern_timeout.c:888-921, sync STOP);
• no callout_reset(&dlc->rd_timeout, ...) site is reachable with rd_state == RFCOMM_DLC_CLOSED (all five require non-CLOSED states).

⇒ the if (callout_active(...)) test at rfcomm_upper.c:293 can only see 0, ⇒ RFCOMM_DLC_DETACH is never set, ⇒ the kfree() branch in rfcomm_dlc_timeout() (rfcomm_dlc.c:203-204) is unreachable dead code. The full production rfcomm_detach() on B completed via the immediate-kfree path; the session self-expired 20 s later with no crash.

Why it matters

Not directly exploitable — the unconditional kfree() is safe because callout_stop() drains. The problem is that this dead machinery is documented as the callout-vs-detach lifetime handler ("If callout is invoking we can't free the DLC so mark it and let the callout release it") when it does no such thing under DragonFly's callout implementation; the genuine race — unsynchronized double-entry into rfcomm_dlc_close() from the softclock thread vs the socket thread — is DF-0724 and is not mitigated by this flag. Anyone fixing DF-0724 by "relying on the DETACH flag" would be building on dead code. NetBSD upstream uses callout_invoking() + callout_destroy() here instead. Info severity (dead code / misleading guard; hardening + divergence).

Fix validation (fix.diff, fix_run.log, fix_build.log)

patch -p3 < fix.diff (both hunks: unconditional documented kfree in rfcomm_detach(); drop the dead release branch in rfcomm_dlc_timeout()), clean rebuild — zero callout_active references remain in the module — same trigger: identical full lifecycle, same observations, no crash (fix_run.log). Removal validated as behavior-preserving cleanup. fix_status: fixed (baseline_reproduced=1, patched_reproduced=0 — nothing bad exists to reproduce; lifecycle is unchanged and clean by design of the cleanup).

Bottom line

Provable dead code demonstrated against verbatim production code on the guest; the deferred-free "safety net" for the DLC timer never engages under DragonFly's callout API; cleanup fix applied and validated as behavior-preserving.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.