DF-5776 VERDICT — reproduced (root-gated defect, no unpriv impact); fix validated

The claim (pass-2 lead from task_log 2026-10-07)

"pi_reg has NO upper bound at the ioctl layer (pci_user.c:610-611 checks only >=0 + alignment) — cfgreg's clamp is the only net before outl(0xcf8)"

Verification: TRUE, and the net holds — but it launders failure into success

Source trace

1. sys/bus/pci/pci_user.c:602-614 — PCIOCREAD/PCIOCWRITE validate only io->pi_reg < 0 and io->pi_reg & (io->pi_width - 1). Any aligned non-negative int (0 .. 0x7FFFFFFC) is accepted. There is no upper bound.
2. Dispatch: PCIB_WRITE_CONFIG(brdev, bus, dev, func, io->pi_reg, io->pi_data, io->pi_width) at pci_user.c:633-639 and the read twin at :651-657 → legacy_pcib_write_config (sys/bus/pci/x86_64/pci_bus.c:71-74) → pci_cfgregwrite/read (sys/bus/pci/x86_64/pci_cfgreg.c:167/:143).
3. The only net is the MD layer: - type-1: pci_cfgenable (pci_cfgreg.c:187-198) rejects (unsigned)reg > PCI_REGMAX (255) by returning dataport = 0; pcireg_cfgread then returns its -1 sentinel (:214) and pcireg_cfgwrite does nothing (:243-244). The outl(0xcf8) at :194 is only ever reached with reg <= 255 masked & ~0x03 — there is no path from pi_reg to an unbounded raw port access. - ECAM: pciereg_cfgread/cfgwrite (:322-324, :348-350) reject reg > PCIE_REGMAX (4095) and mask reg & 0xfff in PCIE_VADDR (:308-313), so 256..4095 is the legitimate extended-config range.
4. But pci_user.c:658 sets error = 0 unconditionally: an access that the MD layer dropped is reported to userland as success, and a dropped read returns pi_data = 0xffffffff — indistinguishable from the genuine all-ones value read from a vacant function. pciconf -w-style tools cannot detect that their write never happened.

Live proof (guest, kernel #0, uid=0, securelevel=-1, i440FX ⇒ type-1)

run.log (decisive) and run.baseline-freshboot.out (re-verified after vm.sh reset with-src):

• reg=0 w=4 → rc=0 data=0x10001af4 (plumbing works; virtio NIC 0:3:0)
• reg=256/4092/4096/65536/2147483644 w=4 → rc=0 errno=0 data=0xffffffff (silent success + sentinel data, up to INT_MAX-3)
• PCIOCWRITE reg=256/4096/2147483644 val=0xdeadbeef → rc=0 errno=0 for all three; readback 0xffffffff; device vendor register unchanged; guest healthy (writes dropped — harmless by construction on type-1)
• reg=-4 and reg=2 w=4 → rc=-1 errno=22 — these two checks are the only validation at the ioctl layer
• unpriv control (/tmp/opengate as maxx): O_RDWR → EACCES, O_RDONLY → EPERM (pci_user.c:82, caps_priv_check_self(SYSCAP_RESTRICTEDROOT)) — the whole surface is root-gated, matching the DF-5570 live probes

Fix validation (mandatory-cycle executed)

fix.diff (generated against pristine sys/) bounds pi_reg at the ioctl layer using the overflow-safe form pi_reg > PCIE_REGMAX + 1 - pi_width and adds sign/bound/alignment validation for PCIOCGETBAR's pbi_reg (pci_user.c:685-698 post-patch; GETBAR previously passed pbi_reg to pci_read_config(..., 4) with zero validation at :711 — contained in practice only by the resource_list_find rid match, live-probed EINVAL).

Cycle: vm.sh reset with-src → patch -p0 in guest /usr/src → baseline re-verified on the fresh boot (silent success still present) → make nativekernel KERNCONF=X86_64_GENERIC + make installkernel (fix_build.log, build_rc=0) → reboot into kernel #1 (Sun Oct 11 19:51:10) → same probe (run.patched.out):

• reg=4096/65536/2147483644 reads and writes → rc=-1 errno=22 (EINVAL)
• reg=0 → still 0x10001af4; reg 256..4095 still accepted (required for ECAM extended config space); GETCONF pagination byte-identical; GETBAR valid BAR (0:2:0 reg 0x10 → base 0xfd000008 len 16M) unchanged; guest healthy

fix_status = fixed (bad behavior gone on the patched kernel; baseline reproduced 1, patched reproduced 0).

Residual (documented, not fixed here)

On type-1-only machines, pi_reg in [256, 4095] is still a silent no-op-with-success: that range must remain accepted because it is the real PCIe extended config space on ECAM machines, and mechanism capability is MD-private. Closing it fully needs failure propagation from the cfgreg layer (pcireg_cfgread/write returning void / sentinel) — that is DF-5570's layer (sys/bus/pci/x86_64/pci_cfgreg.c), kept separate on purpose.

Impact ceiling

None beyond privileged misuse: the device is root-gated at open (pci_user.c:82-88) and read/write ioctls additionally require FWRITE with securelevel <= 0 (pci_user.c:85-88, :324-330). No OOB access exists — outl(0xcf8)/ECAM writes are clamped and masked in pci_cfgreg.c. The defect is a validation/honest-error gap that misleads privileged tooling (and, per DF-5570's companion gap, would let misaligned/straddling offsets through on ECAM machines). Severity Low; CWE-20.

Negative results (pass-2 classes hunted and killed)

• ioctl copyin sizes / struct versioning: sys/kern/sys_generic.c:668-697 marshals exactly IOCPARM_LEN(cmd) bytes into kernel memory (bzero for IOC_OUT); every _IOWR size (pciio.h:125-129, pci_user.c:227-229) covers all fields the driver touches (pci_io_old 16 B, pi_data at offset 12; pci_conf_io 48 B used by both GETCONF variants). No mismatch.
• a_data is kernel memory — no user-pointer deref in this driver; the PCIOCREAD_OLD repoint of ap->a_data to stack iodata (pci_user.c:591-599) writes results back via io_old (the marshalled buffer, :641-648), and the framework copies back from its own buffer (sys_generic.c:729-730). Safe.
• GETCONF pagination/counter arithmetic (pci_user.c:386-393, 548-551): iolen = min(round_down(match_buf_len), pci_numdevs * confsz) bounds every copyout; num_patterns * pbufsz != pat_buf_len exact-size check :420-425; offset >= pci_numdevs rejected :365; live-probed with match_buf_len=0xFFFFFFFF (7 bounded records), page size 2 (offset 2→4), bad pattern length (EINVAL), stale generation (LIST_CHANGED). No overflow: all size math is 64-bit size_t.
• PCIOCGETBAR garbage pbi_reg: contained by resource_list_find rid match (:697-704, live EINVAL for 1 / -1); hardened anyway in fix.diff.
• devq traversal/lifetime races: DF-1068 / DF-2326 — not re-reported.
• PCIOCGETCONF_OLD stack leak: DF-1067 — not re-reported.
• No selinfo/kqueue and no PCIOCDETACH/PCIOCMATCH ioctls exist in this file (prompt description stale; rg selrecord|knote|DETACH = no hits).
• Dead code pci_user.c:660-664 references undeclared cmd under #ifdef COMPAT_FREEBSD4 — unbuildable if ever enabled; compiled out everywhere (PRE7_COMPAT comes from __DragonFly__, :171-173).
• brdev NULL deref (:625-626): unreachable on x86 — every pci_devq device has a pci-bus parent and pcib grandparent.
• securelevel at open only (:85-88): standard BSD fd semantics, same as FreeBSD; not a defect.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.