# DF-0273 — SIOCSIFDESCR missing break → fall-through to SIOCSIFFLAGS

## Verdict: REPRODUCED

**Impact:** privileged-ioctl logic corruption (interface flag manipulation).
Setting an interface description via `SIOCSIFDESCR` corrupts the interface
flags because the `case SIOCSIFDESCR` block in `sys/net/if.c` has no `break`
before `case SIOCSIFFLAGS`. The fall-through reinterprets
`ifr_buffer.length` (which aliases `ifr_flags` via the `ifr_ifru` union,
`sys/net/if.h:259-261`) as the new flags value.

## Mechanism

1. `sys/net/if.c:2100` — `case SIOCSIFDESCR:` sets `ifp->if_description`
   and at line 2131-2132 frees the old description buffer.
2. **No `break;`** between line 2132 and `case SIOCSIFFLAGS:` at line 2134.
3. Execution falls through into the SIOCSIFFLAGS handler at line 2138:
   `new_flags = (ifr->ifr_flags & 0xffff) | (ifr->ifr_flagshigh << 16)`.
4. Because `ifr_flags` is `ifr_ifru.ifru_flags[0]` which overlaps the low
   16 bits of `ifr_ifru.ifru_buffer.length` (both start at offset 0 of the
   union, `if.h:244-261`), `new_flags` is driven by the description length.
5. For a 2-byte description ("a\0"), `new_flags = 2` (IFF_BROADCAST, no
   IFF_UP). Line 2142-2144: `if (ifp->if_flags & IFF_UP && (new_flags & IFF_UP)==0)`
   → `if_down(ifp)` — the interface goes DOWN.

## Demonstration

Tested on the guest (root; SIOCSIFDESCR requires `caps_priv_check(SYSCAP_RESTRICTEDROOT)`):

```
[*] lo0 flags BEFORE SIOCSIFDESCR:
  flags=0xffff8041 <UP,RUNNING,MULTICAST,PPROMISC,>
[*] lo0 flags AFTER SIOCSIFDESCR(len=2):
  flags=0xffff8040 <RUNNING,MULTICAST,PPROMISC,>

[!] DF-0273 REPRODUCED: IFF_UP cleared by setting a description
    (fall-through SIOCSIFDESCR -> SIOCSIFFLAGS).
[!] new_flags was driven by ifr_buffer.length==2 (IFF_BROADCAST),
    bypassing the SIOCSIFFLAGS intent.
```

Setting a description of length 2 cleared IFF_UP on lo0 — the interface was
brought down by a description-set ioctl.

## Threat model

This is a **privileged** bug (SIOCSIFDESCR requires RESTRICTEDROOT = root,
CVSS PR:H). The realistic impact is operational: a root admin action
(`ifconfig em0 description "..."`) has the unintended side effect of
corrupting interface flags — bringing the interface down, or setting
arbitrary flag bits via the description length. On vtnet0 (the management
interface), `ifconfig vtnet0 description "a"` would drop the admin's SSH
session. This is a logic/operational bug, not a privilege escalation.

## Fix

Add `break;` after the `kfree(odescrbuf)` in the SIOCSIFDESCR case
(`sys/net/if.c:2132`). See `fix.diff`.

## PoC changes

Wrote `descr_fallthrough.c` from scratch (the poc dir was empty). The PoC
creates a throw-away interface, brings it UP, issues `SIOCSIFDESCR` with a
description whose length aliases to a flag value, and reports the before/after
flags to confirm the fall-through.