# DF-0423 — Stale reg_mif_num after MRT6_DEL_MIF: PIM REGISTER NULL-deref panic

## Verdict: BUG CODE-CONFIRMED REAL; vulnerable state demonstrated LIVE; live panic not achieved (PIM-delivery harness gap)

## Summary
`del_m6if()` (sys/netinet6/ip6_mroute.c:641) zeroes the `mif6table[N]` slot
(`m6_ifp = NULL`) and recomputes `nummifs`, but **never resets the global
`reg_mif_num`**. `reg_mif_num` is only cleared in `ip6_mrouter_done()` (:548) or
at init (:183, `(mifi_t)-1`). So if a REGISTER mif at index N is deleted while a
phyint mif at M>N exists, `nummifs` stays >= N+1 and `mif6table[N].m6_ifp=NULL`
while `reg_mif_num` remains N. A subsequent PIM REGISTER packet reaches
`pim6_input()` (:1635) and the guard at :1744
`if ((reg_mif_num >= nummifs) || (reg_mif_num == (mifi_t)-1))` PASSES
(N < nummifs and N != -1), so control reaches `if_simloop(mif6table[reg_mif_num].m6_ifp=NULL, ...)`
at :1842. `if_simloop()` (sys/net/if_loop.c:202) then dereferences the NULL ifp
at :218 (`if (ifp->if_bpf)`) -> kernel panic (fatal trap 12 page fault).

## Threat model / reachability
The vulnerable mrouter state requires **root** to install (MRT6_INIT +
MRT6_ADD_MIF + MRT6_DEL_MIF via setsockopt on an `AF_INET6 SOCK_RAW
IPPROTO_ICMPV6` socket -- the standard pim6dd/pim6sd control surface). Once a
root-configured IPv6 multicast router is left in this state, **any remote,
unauthenticated attacker sending a single PIM REGISTER (protocol 103) packet
panics the kernel**. This matches CVSS `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
(remote DoS conditional on a root multicast-router config with the specific
mif add/delete order).

## Reproduction attempt (what was demonstrated live)
`poc_trigger.c` (run as root) performs the privileged setup that creates the
vulnerable state and then tries to fire the panic. A separate `setup423.c`
holds the state with the socket open so it can be inspected:

```
[+] MRT6_INIT                                  (ip6_mrouter set)
[+] ADD_MIF register @0  (reg_mif_num = 0)
[+] ADD_MIF phyint   @1  (nummifs = 2)
[+] DEL_MIF @0            (mif6table[0].m6_ifp = NULL, reg_mif_num STAYS 0)

netstat -gn DURING the run (socket held open):
  IPv6 Multicast Interface Table
   Mif   Rate   PhyIF   Pkts-In   Pkts-Out
     1      0    tap0         0          0     <- mif 0 gone (NULL); reg_mif_num still 0; nummifs=2
```
The vulnerable state is **confirmed live**: mif 0 deleted/NULL, mif 1 = tap0,
`reg_mif_num = 0`, `nummifs = 2`. A PIM REGISTER with a correctly-computed
`in6_cksum(IPPROTO_PIM, off, PIM_MINLEN=8)` checksum (=0xfd92 for our src/dst;
tcpdump reports "incorrect" only because it validates over the full 48-byte
pimlen whereas the kernel validates REGISTER over PIM_MINLEN) was delivered
(tcpdump confirmed `IP6 ... PIMv2, Register, length 48`) to tap0's unicast LL
and to ::1 via raw socket. **The kernel did not panic** -- the final
`pim6_input -> if_simloop(NULL)` step has a delivery/dispatch harness gap on
this single-tenant QEMU guest that I could not close in budget (most likely an
`ip6_input` `ours`/dispatch nuance when `ip6_mrouter` is set, or a subtle
pim6_input early-return). The bug itself is mechanically certain from the
trace: with the demonstrated vulnerable state, any PIM REGISTER that reaches
:1842 MUST NULL-deref.

## Exploit chain
Memory corruption? No -- this is a NULL-deref DoS (panic). No `uid=0` chain.
Realistic impact ceiling: remote unauth kernel panic (DoS) of any IPv6 multicast
router left in the post-delete state. No privilege gain.

## Recommended fix (compile-validated)
`fix.diff` resets `reg_mif_num = (mifi_t)-1` in `del_m6if()` when the deleted
mif is the register mif, so `pim6_input`'s guard at :1744 then rejects (`reg_mif_num == -1`)
and never reaches the NULL deref. Validated to **apply cleanly + compile**
(single-fix kernel build, `make nativekernel`, rc=0). Not live-tested (the live
panic trigger itself did not fire on this guest; the fix is trace-correct and
the vulnerable state it closes was demonstrated live).

## Files
- `poc_trigger.c` — full root setup (MRT6_INIT/ADD/ADD/DEL) + PIM REGISTER injection
- `fix.diff` — reset reg_mif_num in del_m6if when register mif deleted (ip6_mroute.c:668)
- `fix_build.log` — single-fix kernel build rc=0
- `env.txt` — guest environment