DF-0611 / run.log
--- run 1 ---
DF-0611 userspace harness — modeled on sys/netgraph7/ng_nat.c:690-763
test cap read@off write@off BUG_OOB? FIX_rej?
------------------------------------------------------------------------------
trigger-frame cap=80 ip_hl=15 ip_len=80 80 ACCEPT
-> BUG read@72 write@76 m_len=80 (cap=80) (in-bounds)
-> FIX accepts the frame
lying-ip_len cap=24 ip_hl=5 ip_len=200 24 n/a REJECT
-> BUG read@32 write@-1 m_len=200 (cap=24) *** OOB ***
-> FIX REJECTs the frame
sub-min-ip cap=12 ip_hl=5 ip_len=20 12 n/a n/a REJECT
-> BUG read@-1 write@-1 m_len=0 (cap=12) (in-bounds)
-> FIX REJECTs the frame
huge-ip_hl cap=40 ip_hl=15 ip_len=80 40 n/a REJECT
-> BUG read@72 write@-1 m_len=80 (cap=40) *** OOB ***
-> FIX REJECTs the frame
well-formed cap=40 ip_hl=5 ip_len=40 40 n/a ACCEPT
-> BUG read@32 write@-1 m_len=40 (cap=40) (in-bounds)
-> FIX accepts the frame
------------------------------------------------------------------------------
BUG: 2/5 malformed frames drove OOB access.
FIX: 3/5 malformed frames rejected by guards.
RESULT: BUG CONFIRMED — 2 frames drive OOB under the buggy logic; FIX rejects all 3 malformed frames and accepts both valid ones.
RUN_EXIT=0
--- run 2 ---
DF-0611 userspace harness — modeled on sys/netgraph7/ng_nat.c:690-763
test cap read@off write@off BUG_OOB? FIX_rej?
------------------------------------------------------------------------------
trigger-frame cap=80 ip_hl=15 ip_len=80 80 ACCEPT
-> BUG read@72 write@76 m_len=80 (cap=80) (in-bounds)
-> FIX accepts the frame
lying-ip_len cap=24 ip_hl=5 ip_len=200 24 n/a REJECT
-> BUG read@32 write@-1 m_len=200 (cap=24) *** OOB ***
-> FIX REJECTs the frame
sub-min-ip cap=12 ip_hl=5 ip_len=20 12 n/a n/a REJECT
-> BUG read@-1 write@-1 m_len=0 (cap=12) (in-bounds)
-> FIX REJECTs the frame
huge-ip_hl cap=40 ip_hl=15 ip_len=80 40 n/a REJECT
-> BUG read@72 write@-1 m_len=80 (cap=40) *** OOB ***
-> FIX REJECTs the frame
well-formed cap=40 ip_hl=5 ip_len=40 40 n/a ACCEPT
-> BUG read@32 write@-1 m_len=40 (cap=40) (in-bounds)
-> FIX accepts the frame
------------------------------------------------------------------------------
BUG: 2/5 malformed frames drove OOB access.
FIX: 3/5 malformed frames rejected by guards.
RESULT: BUG CONFIRMED — 2 frames drive OOB under the buggy logic; FIX rejects all 3 malformed frames and accepts both valid ones.
RUN_EXIT=0
--- run 3 ---
DF-0611 userspace harness — modeled on sys/netgraph7/ng_nat.c:690-763
test cap read@off write@off BUG_OOB? FIX_rej?
------------------------------------------------------------------------------
trigger-frame cap=80 ip_hl=15 ip_len=80 80 ACCEPT
-> BUG read@72 write@76 m_len=80 (cap=80) (in-bounds)
-> FIX accepts the frame
lying-ip_len cap=24 ip_hl=5 ip_len=200 24 n/a REJECT
-> BUG read@32 write@-1 m_len=200 (cap=24) *** OOB ***
-> FIX REJECTs the frame
sub-min-ip cap=12 ip_hl=5 ip_len=20 12 n/a n/a REJECT
-> BUG read@-1 write@-1 m_len=0 (cap=12) (in-bounds)
-> FIX REJECTs the frame
huge-ip_hl cap=40 ip_hl=15 ip_len=80 40 n/a REJECT
-> BUG read@72 write@-1 m_len=80 (cap=40) *** OOB ***
-> FIX REJECTs the frame
well-formed cap=40 ip_hl=5 ip_len=40 40 n/a ACCEPT
-> BUG read@32 write@-1 m_len=40 (cap=40) (in-bounds)
-> FIX accepts the frame
------------------------------------------------------------------------------
BUG: 2/5 malformed frames drove OOB access.
FIX: 3/5 malformed frames rejected by guards.
RESULT: BUG CONFIRMED — 2 frames drive OOB under the buggy logic; FIX rejects all 3 malformed frames and accepts both valid ones.
RUN_EXIT=0