ALSA: usb-audio: Audient iD4 (2708:0009) playback stalls at hw_ptr 0 with -EIO after CVE-2026-23208

Package: src:linux
Version: 6.12.115-2
Severity: important
Tags: regression

Dear Maintainers,

Following the update from linux-image-6.12.113+deb13-rt-amd64 (6.12.113-1) to linux-image-6.12.115+deb13.1-rt-amd64 (6.12.115-2), USB audio playback on the Audient iD4 MKII (USB ID: 2708:0009) is completely broken.

Audio capture continues to work normally, but playback fails immediately with -EIO (Input/output error), with the ALSA hardware pointer permanently frozen at hw_ptr: 0.

Reverting / booting back to 6.12.113-1 restores full working playback.

========================================================================
1. Hardware Details
========================================================================
Device: Audient iD4 (MKII revision)
USB ID: 2708:0009
USB Host Controller: AMD Renoir/Cezanne USB 3.1 xHCI (06:00.3)

ALSA /proc/asound/card2/stream0 descriptors:
Format: S32_LE (24 bits)
Channels: 4 (FL FR FC LFE)
Playback Endpoint: 0x01 (1 OUT) (ASYNC)

    wMaxPacketSize: 0x00d0 (1x 208 bytes)
    bInterval: 1 (125 us)
  Sync Endpoint: 0x81 (1 IN) (Interface 2, Altset 1)
    Implicit Feedback Mode: Yes
  Capture Endpoint: 0x81 (1 IN) (ASYNC)
    wMaxPacketSize: 0x00d0 (1x 208 bytes)

========================================================================
2. Symptoms & Diagnostic Findings
========================================================================
- Capture:
Running 'arecord -D hw:2,0 -f S32_LE -r 48000 -c 4' works correctly. /proc/asound/card2/pcm0c/sub0/status shows hw_ptr advancing normally.

- Playback:
Running 'aplay -D hw:2,0 /tmp/test.wav' or 'speaker-test -D hw:2,0'
fails: aplay: pcm_write:2178: write error: Input/output error (-5)

Low-level inspection of /proc/asound/card2/pcm0p/sub0/status shows:

    state: RUNNING
    delay: 3072
    hw_ptr: 0
    appl_ptr: 3072

The stream enters SNDRV_PCM_STATE_RUNNING, but hw_ptr never advances even after several hundred milliseconds. As soon as the buffer is full, subsequent writes block until timing out with -EIO.

- Sound Server Impact:
In PipeWire, the follower playback node repeatedly resyncs every
period: spa.alsa: hw:2,0p: follower avail:2048 delay:2048 target:1280 thr:256, resync

========================================================================
3. Suspected Regression Cause
========================================================================
The Debian 6.12.115-1 changelog includes:
- ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208)

This patch introduces strict frame-size bounds checking / clamping on implicit feedback endpoints. For devices such as the Audient iD4 MKII with 4-channel 32-bit audio (16 bytes/frame) and a 208-byte packet descriptor, the calculation appears to reject or drop outgoing playback URBs from being scheduled against the sync endpoint, preventing completion callbacks and freezing the hardware pointer at 0.

Please consider reviewing the frame validation logic in CVE-2026-23208 for multi-channel implicit feedback devices or adding a quirk for 2708:0009.

Thank you.