> **Automated-tool disclosure:** AI/LLM-assisted source review and harness generation > were used while investigating this issue. Every claim and reproducer below was > manually triaged against QEMU source, a real guest run, debugger output, latest-upstream > ASan output, a negative control, and a reversible one-line cause toggle. ## Host environment - Operating system: Ubuntu 25.04 - OS/kernel version: Linux 6.14.0-37-generic - Architecture: x86_64 - QEMU flavor: `qemu-system-x86_64`, system emulation; direct command line; TCG/qtest - QEMU version: - Latest upstream: QEMU 11.0.90, commit `b9e9a55f9950b78ef4c940d0599409c614f36766` (2026-07-18), ASan+UBSan, debug symbols, `-O1`. - Guest-path confirmation: Ubuntu package QEMU 9.2.1, `1:9.2.1+ds-1ubuntu5.2`. - QEMU command line: Actual guest-path run: ```bash MALLOC_PERTURB_=42 qemu-system-x86_64 \ -name eepro100-guestonly \ -machine pc -accel tcg,thread=multi -smp 2 -m 512 \ -display none \ -kernel guest/vmlinuz-virt \ -initrd guest/initramfs-virt \ -append 'console=ttyS0' \ -netdev user,id=n0 \ -device i82559c,netdev=n0,id=nic1 \ -serial unix:/tmp/eepro100.serial,server=on,wait=off \ -qmp unix:/tmp/eepro100.qmp,server=on,wait=off \ -monitor none ``` Latest-upstream deterministic ASan run: ```bash ASAN_OPTIONS='abort_on_error=1:detect_leaks=0:fast_unwind_on_malloc=0:symbolize=1' \ UBSAN_OPTIONS='halt_on_error=1:print_stacktrace=1' \ MALLOC_PERTURB_=42 \ ./qemu-system-x86_64 \ -machine pc,accel=qtest -display none \ -device i82559c,id=nic1 \ -qmp unix:/tmp/eepro100-qtest/qmp.sock,server=on,wait=off \ -qtest unix:/tmp/eepro100-qtest/qtest.sock,server=on,wait=off \ -monitor none ``` ## Emulated/Virtualized environment - Operating system: Alpine Linux initramfs for the actual guest path; qtest for the deterministic latest-upstream memory-safety reproducer. - OS/kernel version: Linux 6.12.81-0-virt in the actual guest run. - Architecture: x86_64, `pc` (i440FX/PIIX) machine. ## Description of problem `e100_nic_realize()` registers `nic_reset` in QEMU's global legacy reset container: ```c qemu_register_reset(nic_reset, s); ``` The callback retains `opaque = EEPRO100State *`. The corresponding `pci_nic_uninit()` path unregisters VMState and releases the EEPROM/NIC, but never calls `qemu_unregister_reset(nic_reset, s)`. On a `pc` machine, a guest can execute the ACPI PCI slot eject method for the `i82559c`. The ACPI hotplug path calls `hotplug_handler_unplug()` and `object_unparent()`, and the device state is subsequently freed by QOM/RCU. The legacy reset object survives. A later guest reboot/system reset walks the global reset container and calls: ```text legacy_reset_hold() -> nic_reset(freed EEPRO100State *) -> memset(&s->mult[0], 0, sizeof(s->mult)) ``` Latest-upstream ASan reports this first write as an 8-byte heap-use-after-free at `hw/net/eepro100.c:616`. Relevant source locations at the tested commit: - `hw/net/eepro100.c:611-618`: `nic_reset()` writes through `s`. - `hw/net/eepro100.c:1823-1831`: `pci_nic_uninit()` lacks reset unregistration. - `hw/net/eepro100.c:1884`: registration of `nic_reset` with `s`. - `hw/core/reset.c:53-58,69-76,95-103`: storage and invocation of `func(opaque)`. - `hw/core/reset.c:153-160`: `qemu_unregister_reset()`. - `hw/acpi/pcihp.c:178-220`: guest ACPI slot-eject path. ### Trigger and privilege boundary The end-to-end guest sequence was performed as guest root: 1. Write `0` to the eepro100 ACPI slot's sysfs `power` attribute. 2. Reboot the guest. No QMP `device_del` or other management deletion command was used in that run. Pwndbg stopped the packaged QEMU main thread on SIGSEGV in the eepro100 reset routine, above the resettable traversal and `qemu_system_reset()`. The deterministic latest-upstream ASan run used qtest to perform the same guest I/O write to the PIIX4 ACPI PCI eject register, then used QMP `system_reset` only for a stable downstream reset trigger. QMP emitted `DEVICE_DELETED` for `nic1` before the reset, proving the object was unplugged. ### Impact and non-claims Confirmed impact is termination of the QEMU process that owns the VM: a per-VM host-side denial of service plus a write-UAF primitive. The outer Ubuntu host remained available. I am **not** claiming physical-host failure, information disclosure, control-flow hijack, RCE, or VM escape. No heap-reclaim or ASLR-bypass work was attempted. The available nested host did not expose a usable `/dev/kvm`, so the runtime validation used TCG/qtest. KVM/HVF behavior remains untested. I am reporting confidentially first because the defect is guest-triggerable device-model memory corruption, while leaving security-boundary classification to the maintainers. ## Steps to reproduce ### A. Actual guest-only path 1. Launch QEMU directly with the first command line under **Host environment**. 2. In the guest, locate the ACPI slot containing Intel `8086:1229` (`i82559c`). In the tested launch it was slot 3. 3. As guest root, execute: ```sh echo 0 > /sys/bus/pci/slots/3/power echo "SELF_EJECT_RC=$?" reboot -f ``` 4. Observe that the QEMU process exits. The tested package run produced: ```text SELF_EJECT_RC=0 QEMU_ALIVE_AFTER_TRIGGER=0 QEMU_EXIT_STATUS=139 ``` 5. Under pwndbg, the main-thread stack was: ```text eepro100 static reset routine -> legacy/resettable reset traversal -> resettable_reset -> qemu_system_reset -> qemu_main_loop ``` ### B. Latest-upstream source-symbolized ASan path 1. Build QEMU commit `b9e9a55f9950b78ef4c940d0599409c614f36766` with ASan, UBSan, debug symbols, and optimization level `-O1`. 2. Launch the second command line under **Host environment**. 3. Connect to QMP, enable capabilities, and run `query-pci`. In the tested launch `nic1` was slot 4. 4. Through the qtest socket, issue the guest-equivalent ACPI eject register write: ```text outl 0xae08 0x00000010 ``` `0xae08` is `ACPI_PCIHP_ADDR_PIIX4 + ACPI_PCIHP_SEJ_BASE`; bit 4 selects slot 4. 5. Confirm QMP emits: ```json {"event":"DEVICE_DELETED","data":{"device":"nic1","path":"/machine/peripheral/nic1"}} ``` 6. Send QMP `system_reset`. 7. Observe ASan abort status 134 and the UAF shown below. A bounded script implementing steps 2-7 is included as `repro-qtest-asan.sh`; invoke it as: ```bash ./repro-qtest-asan.sh guestonly /tmp/eepro100-qtest \ /path/to/build-asan/qemu-system-x86_64 ``` ## Additional information ### ASan evidence ```text ERROR: AddressSanitizer: heap-use-after-free WRITE of size 8 #0 memset #2 nic_reset ../hw/net/eepro100.c:616 #3 legacy_reset_hold ../hw/core/reset.c:76 ... #10 qemu_devices_reset ../hw/core/reset.c:176 #11 pc_machine_reset ../hw/i386/pc.c:1664 #12 qemu_system_reset ../system/runstate.c:559 freed by thread T1 here: #0 free #1 object_finalize ../qom/object.c:674 #2 object_unref ../qom/object.c:1324 #3 bus_free_bus_child ../hw/core/qdev.c:55 #4 call_rcu_thread ../util/rcu.c:324 previously allocated by thread T0 here: #1 g_malloc #2 object_new_with_type ../qom/object.c:695 #4 qdev_new ../hw/core/qdev.c:150 ``` ### Root-cause confirmation | Run | Eject | `qemu_unregister_reset()` added | Result | |---|---:|---:|---| | Unmodified upstream | yes | no | ASan UAF, exit 134 | | Reset-only negative control | no | no | QEMU alive; no ASan error | | One-line cause toggle | yes | yes | `DEVICE_DELETED`; QEMU alive; no ASan error | | Patch reversed and rebuilt | yes | no | Same ASan UAF returns, exit 134 | The exact cause toggle was: ```diff static void pci_nic_uninit(PCIDevice *pci_dev) { EEPRO100State *s = DO_UPCAST(EEPRO100State, dev, pci_dev); + qemu_unregister_reset(nic_reset, s); vmstate_unregister(VMSTATE_IF(&pci_dev->qdev), s->vmstate, s); ``` This is a proposed minimal fix, not a submitted upstream patch. A regression test should hot-eject `i82559c`, wait for deletion, and reset the machine under ASan. A longer-term alternative is to bind reset to the device's Resettable lifetime. ### Attachments - [repro-qtest-asan.sh](/uploads/4866868117621d5c3a34964c2bcce077/repro-qtest-asan.sh) - [qemu.log](/uploads/535d75dce405d2832f7c9cbec7ad929d/qemu.log)