# DF-0536 — Unprivileged kernel heap over-read via non-NUL-terminated sockaddr_ng

**Verdict:** REPRODUCED (unprivileged heap over-read). **Fix VALIDATED.**

## Bug
`ng_connect_data()` (cited `sys/netgraph7/socket/ng_socket.c:752-778`; **same bug**
in the shipped `sys/netgraph/socket/ng_socket.c:644-673`) passes `sap->sg_data`
to the path resolver **without** the NUL-termination check that `ng_bind()`
performs. The resolver does `strncpy(fullpath, address, NG_PATHSIZ-1)` which
scans up to ~511 bytes past the `sa_len`-byte `M_SONAME` allocation — a kernel
heap over-read.

Data sockets require **no privilege** (`ngd_attach` has no `caps_priv_check`),
so an unprivileged user can trigger this with `connect(2)`.

## Run
- **Precondition** (admin, stock modules): `kldload netgraph; kldload ng_socket`
- **Build:** `cc -O2 -o df0536 df0536.c`
- **Run (as unpriv user):** `./df0536`

## Result
- **Baseline** (pristine shipped module): `connect` → `errno=6 (ENXIO)` — the
  `strncpy` over-read fires before the path lookup. Bug exercised.
- **Fixed module:** `connect` → `errno=22 (EINVAL)` — `ng_connect_data` rejects
  the non-NUL-terminated sockaddr before calling the resolver. OOB path closed.

## Impact
Read-only primitive → heap info leak (no write). A bounded 511-byte read into
contiguous slab pages does not reliably panic, so realistic impact is a silent
over-read / minor info side-channel, not a reliable DoS. No `uid=0` escalation
(read-only primitive is a valid hard blocker for an escalation chain).

See `VERDICT.md` for the full line-cited trace and `fix.diff` / `fix.v4.diff`
for the patch (the v4 variant was build-validated on this guest).