Skip to content

(DICE-2) fix interference with other drivers (UAD) + Aggregation#49

Merged
mrmidi merged 2 commits into
mrmidi:mainfrom
alicankaralar:fix/async-hardening
Jul 10, 2026
Merged

(DICE-2) fix interference with other drivers (UAD) + Aggregation#49
mrmidi merged 2 commits into
mrmidi:mainfrom
alicankaralar:fix/async-hardening

Conversation

@alicankaralar

@alicankaralar alicankaralar commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

BUGFIX:
Another audio interface driver (Universal Audio) on the system was interfering with and preventing this driver from mounting the FW device after it being turned on. This PR fixes this issue. As a bonus, now you can aggregate your interface with different interfaces - in my case I can aggregate Midas Venice with UAD Apollo Twin Thunderbolt using native MacOS aggregate feature.
Sits on the Venice PR and has to be merged after.

@mrmidi

mrmidi commented Jul 9, 2026

Copy link
Copy Markdown
Owner

@copilot resolve the merge conflicts in this pull request

alicankaralar and others added 2 commits July 9, 2026 20:49
…eardown

IsochReceiveContext was an OSObject created via plain `new` (MakeOSObject)
instead of OSTypeAlloc. In DriverKit, OSMetaClassBase has no constructor
setting refcount — only OSObjectAllocate() (the OSTypeAlloc path) does — so
the object was born with refcount 0. The single release() in ~IsochService
then underflowed and hit the DriverKit over-release assert, SIGABRT-ing the
whole dext during ASFWDriver::free() (crash report 2026-07-03 13:21). A
crashed dext is not relaunched, so the device never re-published until
reboot; this also explains recurring shutdown stalls.

Nothing needs OSObject semantics here (no OSAction, no cast, no IIG), so
make it a plain final class owned by std::unique_ptr, matching
IsochTransmitContext, and delete the MakeOSObject helper.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ammed the AR path

OHCI §8.4.2: AR bufferFill appends a status/timestamp trailer quadlet to
every received packet. ARPacketParser treated it as optional: a packet whose
header+payload ended flush with the received-byte frontier parsed as
"complete" with totalLength 4 bytes short. The trailer then arrived as an
orphan quadlet at the head of the unread stream, every subsequent parse was
misaligned (responses completed against unknown tLabels, then an unparseable
byte pattern), and the AR response path jammed permanently — all async on
the bus timed out (ackCode=0x1: devices kept ACKing) until reboot.

Field trace 2026-07-03 13:53:28: tLabel=6's 104-byte read-block response
consumed as 120 bytes, its trailer left as the "offset 0/4" tail in
buffer[5]; three real responses destroyed ("No transaction for key"),
parser stuck at offset 56 forever. Chunked DICE section reads made the
flush-boundary case likely enough to hit on the third bring-up.

Fix: no trailer in the window means the packet is incomplete — return
nullopt so the tail is preserved and the stitched cross-buffer retry picks
the packet up whole once the trailer lands.

Adds a parser-level regression test and a ring-level reproduction of the
exact trailer-only straddle; fixes the tLabel-extraction test fixture to be
a valid AR DMA image (trailer included).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@alicankaralar alicankaralar force-pushed the fix/async-hardening branch from 9fb6765 to b122c74 Compare July 9, 2026 18:54
@mrmidi mrmidi merged commit 0e3ca7e into mrmidi:main Jul 10, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants