# DF-0670 — PoC evidence pack

## Summary
- **File:** `sys/net/ipfw3_basic/ip_fw3_table.c:88-98` (table_create_dispatch)
- **Claim:** `ip_fw3_ctl_x` strips the 4-byte `ip_fw_x_header` from
  `sopt_val` without re-validating `sopt_valsize`; the dispatched
  handler then reads `ioc_table->type` (offset 4) and `ioc_table->name`
  (offset 12..43) from a kernel buffer that may be only 4-8 bytes long
  → heap OOB read into `table_ctx`. Read back via
  `getsockopt(IP_FW_TABLE_LIST)`.

## Verdict
**REPRODUCED at source level** — the OOB read code path IS executed
(setsockopt returns 0). However, on this guest's slab state the
leaked bytes are zero — no actual info leak observed in this PoC run.
The bug is real; the practical info-leak ceiling requires heap
grooming. See `VERDICT.md`.

## Reproduce (root-only)
```sh
./build.sh
ssh dfbsd 'kldload ipfw3; kldload ipfw3_basic; /root/poc/DF-0670/df0670_ipfw3_oob'
# expected: table_ctx[0].type=0x00000000 and name all-zero
# (confirms OOB read ran; no leak on this slab state)
```

## Environment
See `env.txt`.

## Fix
`fix.diff` adds a `sopt_valsize` check in `ip_fw3_ctl_table_sockopt`
rejecting set requests smaller than `sizeof(struct ipfw_ioc_table)`.
**Matches the finding proposal.**