The hdaudio(4) driver in NetBSD lacks proper access control on the /dev/hdaudioN device nodes, allowing unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions. By issuing this ioctl repeatedly from one thread while keeping DMA and IRQs active from another, attackers can trigger a use-after-free race condition in the hdafg_detach() function between stream_stop() and stream_disestablish(). This race condition causes a latched DMA interrupt to dereference a freed callback pointer, resulting in denial of service, kernel panic, or potentially local kernel privilege escalation.

Unprivileged local attackers can exploit this vulnerability to cause denial of service or kernel panic in the audio subsystem. Additionally, the race condition may allow attackers to escalate privileges locally on the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to /dev/hdaudioN device nodes to trusted users only to prevent exploitation.