[REGRESSION 6.12.115] ALSA: usb-audio: Audient iD4 (2708:0009) playback stalls at hw_ptr 0 with -EIO after CVE-2026-23208

[REGRESSION 6.12.115] ALSA: usb-audio: Audient iD4 (2708:0009) playback stalls at hw_ptr 0 with -EIO after CVE-2026-23208

[sub]

Package: src:linux
Version: 6.12.115-2
Severity: important
Tags: regression

Dear Maintainers,

Following the update from linux-image-6.12.113+deb13-rt-amd64
(6.12.113-1) to linux-image-6.12.115+deb13.1-rt-amd64 (6.12.115-2), USB
audio playback on the Audient iD4 MKII (USB ID: 2708:0009) is
completely broken.

Audio capture continues to work normally, but playback fails immediately
with -EIO (Input/output error), with the ALSA hardware pointer
permanently frozen at hw_ptr: 0.

Reverting / booting back to 6.12.113-1 restores full working playback.

========================================================================
1. Hardware Details
========================================================================
Device: Audient iD4 (MKII revision)
USB ID: 2708:0009
USB Host Controller: AMD Renoir/Cezanne USB 3.1 xHCI (06:00.3)

ALSA /proc/asound/card2/stream0 descriptors:
  Format: S32_LE (24 bits)
  Channels: 4 (FL FR FC LFE)
  Playback Endpoint: 0x01 (1 OUT) (ASYNC)
    wMaxPacketSize: 0x00d0 (1x 208 bytes)
    bInterval: 1 (125 us)
  Sync Endpoint: 0x81 (1 IN) (Interface 2, Altset 1)
    Implicit Feedback Mode: Yes
  Capture Endpoint: 0x81 (1 IN) (ASYNC)
    wMaxPacketSize: 0x00d0 (1x 208 bytes)

========================================================================
2. Symptoms & Diagnostic Findings
========================================================================
- Capture:
  Running 'arecord -D hw:2,0 -f S32_LE -r 48000 -c 4' works correctly.
  /proc/asound/card2/pcm0c/sub0/status shows hw_ptr advancing normally.

- Playback:
  Running 'aplay -D hw:2,0 /tmp/test.wav' or 'speaker-test -D hw:2,0'
  fails: aplay: pcm_write:2178: write error: Input/output error (-5)

  Low-level inspection of /proc/asound/card2/pcm0p/sub0/status shows:
    state: RUNNING
    delay: 3072
    hw_ptr: 0
    appl_ptr: 3072

  The stream enters SNDRV_PCM_STATE_RUNNING, but hw_ptr never advances
  even after several hundred milliseconds. As soon as the buffer is
  full, subsequent writes block until timing out with -EIO.

- Sound Server Impact:
  In PipeWire, the follower playback node repeatedly resyncs every
  period: spa.alsa: hw:2,0p: follower avail:2048 delay:2048 target:1280
  thr:256, resync

========================================================================
3. Suspected Regression Cause
========================================================================
The Debian 6.12.115-1 changelog includes:
  - ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208)

This patch introduces strict frame-size bounds checking / clamping on
implicit feedback endpoints. For devices such as the Audient iD4 MKII
with 4-channel 32-bit audio (16 bytes/frame) and a 208-byte packet
descriptor, the calculation appears to reject or drop outgoing playback
URBs from being scheduled against the sync endpoint, preventing
completion callbacks and freezing the hardware pointer at 0.

Please consider reviewing the frame validation logic in CVE-2026-23208
for multi-channel implicit feedback devices or adding a quirk for
2708:0009.

Thank you.