# DF-0261 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ipfw_check_ioc_rule never validates act_ofs<=cmd_len; rule->act_ofs is copied raw from user (line 4515) and ACTION_PTR(f)=cmd+act_ofs, so check-state derefs an OOB opcode -> panic. Root-only (IP_FW_ADD).

## Impact ceiling
none

## Cited refs
- sys/net/ipfw/ip_fw2.c:5311
- sys/net/ipfw/ip_fw2.c:4515

## Fix
Reject the rule in ipfw_check_ioc_rule when act_ofs > cmd_len.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.