# DF-0610 — PoC: NGM_NAT_PROXY_RULE heap OOB read via non-NUL-terminated string

Root-capable local DoS / heap OOB read PoC.

## Status

**LATENT — module does not build in the current tree.**
`sys/netinet/libalias/` is absent and `m_megapullup()` (referenced at
`ng_nat.c:692`) is defined nowhere, so `netgraph7_nat` cannot be compiled
or loaded. This PoC is source-only until libalias / `m_megapullup` are
reintroduced.

## Files

- `poc.c` — sends a `NGM_NAT_PROXY_RULE` control message whose `data` is
  filled with non-NUL bytes and whose `arglen` matches the sent length
  (≥6), forcing `LibAliasProxyRule` to walk the heap past the allocation
  looking for a NUL terminator.

## Build & run (requires a buildable netgraph7_nat + libalias)

```
cc -o poc poc.c
# as root, on a host with a configured ng_nat node named 'nat:'
./poc
```

## Expected outcome

Kernel panic with a faulting RIP inside `LibAliasProxyRule` (most likely
outcome, when the walk hits an unmapped page); OR the syscall returns
success and the rule is stored (latent corruption if the leaked bytes
happen to parse as a valid rule).

## Notes for the per-PoC verifier

- Trigger requires root (`SYSCAP_RESTRICTEDROOT` on `ngc_attach` at
  `sys/netgraph7/socket/ng_socket.c:182-184`).
- Module must be buildable first — libalias + `m_megapullup` must exist.
- The fix adds a `kmalloc(arglen+1, …, M_ZERO)` + `bcopy` + forced NUL
  before handing the string to `LibAliasProxyRule`; verify with
  `git apply findings/poc/DF-0610/fix.diff`.