# DF-0534 — Heap OOB read in ngc_send (ng_mesg under-allocation)

**Verdict:** REPRODUCED (root-only heap over-read). **Fix VALIDATED.**

## Bug
`ngc_send()` (cited `sys/netgraph7/socket/ng_socket.c:254-307`; **same pattern**
in shipped `sys/netgraph/socket/ng_socket.c:201-273`) `kmalloc(len+1)`s exactly
the user payload length, copies it in, then dereferences `ng_msghdr` fields
(`version`, `typecookie`, `cmd`, …) — a 56-byte header — with **no minimum-size
check**. A 1-byte payload → `kmalloc(2)` → `header.typecookie` (offset 16) is
read 14+ bytes past the allocation. In the cited v7 code these OOB reads are
inline and unconditional; in v4 they happen in the message handler after path
resolution.

## Reachability
**Root-only** — control sockets require `caps_priv_check(SYSCAP_RESTRICTEDROOT)`
(`ngc_attach`, `ng_socket.c:182`). This is a root→kernel hardening gap (no
privilege boundary to cross); impact is a root-only heap over-read.

## Run
- **Precondition** (admin, stock modules): `kldload netgraph; kldload ng_socket`
- **Build:** `cc -O2 -o df0534 df0534.c`
- **Run (as root):** `./df0534`

## Result
- **Baseline** (pristine shipped module): `sendmsg` → `errno=2 (ENOENT)` — the
  undersized 1-byte message is accepted and flows into the header-deref path.
- **Fixed module:** `sendmsg` → `errno=22 (EINVAL)` — `ngc_send` rejects
  `len < sizeof(struct ng_msghdr)` before the header is touched.

See `VERDICT.md` for the full trace; `fix.diff` (v7, as cited) and `fix.v4.diff`
(shipped module, build-validated) hold the patch.