# DF-0714 — One-byte OOB read in ng_tcpmss correct_mss

## Finding
The TCP MSS option parser in `ng_tcpmss` (`sys/netgraph7/tcpmss/ng_tcpmss.c:426`)
reads `*(opt+1)` (the option-length byte) for non-EOL/NOP options without
checking `olen >= 2` first. After consuming NOPs (optlen=1 each), `olen` can
reach 1, and `*(opt+1)` reads 1 byte past the TCP options boundary.

The OOB read is **silent**: no panic (byte lands in mbuf data buffer), no leak
(byte not returned to userspace), no corruption (byte only used as `optlen`
for a bounds check).

## Build
```sh
./build.sh
```
Requires: DragonFlyBSD with netgraph7 headers (in base). No external libraries.

## Run
```sh
# Prerequisites: ng_tcpmss module built and loaded (see setup.sh)
./run.sh
```
Requires root (netgraph socket access). In a real deployment, the admin wires
tcpmss into the packet path; the trigger is a crafted TCP SYN from a remote host.

## Expected output
- Test 1 (valid MSS SYN): MSS lowered from 1460 to 536, FixedPkts=1.
- Test 2 (trigger SYN): Packet forwarded unmodified, SYNPkts incremented,
  FixedPkts unchanged. No panic, no crash — the OOB read is silent.
- The definitive proof is the code-level trace in VERDICT.md.

## Files
- `trigger.c` — PoC source (netgraph topology + crafted SYN packets)
- `build.sh` / `run.sh` — build/run scripts
- `setup.sh` — module build/load helper
- `VERDICT.md` — full analysis and code trace
- `fix.diff` — git-apply-able fix
- `build.log` / `run.log` / `fix_run.log` / `fix_build.log` — logs
- `env.txt` — guest environment
- `manifest.json` — artifact catalog