DF-0536 / fix_run.log
=== DF-0536 FIXED (v4 ng_socket.ko + NUL-termination check) — run as maxx (uid 1001) ===
[*] DF-0536: unprivileged AF_NETGRAPH data-socket heap over-read
[*] uid=1001 euid=1001
[+] data socket created (fd=3) - NO privilege required
[*] calling connect() with sg_len=5, payload 3x 'A' (no NUL)
[*] kernel should strncpy() past the 5-byte allocation -> OOB read
[*] connect returned -1, errno=22 (Invalid argument)
RUN_EXIT=0
CONTRAST:
baseline (pristine): errno=6 (ENXIO) - OOB strncpy read fired before path lookup
fixed (+check): errno=22 (EINVAL) - ng_connect_data rejects non-NUL-terminated
sockaddr BEFORE calling ng_path2node -> no OOB read.
=> fix closes the bug.