# DF-0727 — NULL-pointer dereference in ng_tee NGM_FLOW_COOKIE handler

## Summary

A NULL-pointer dereference in the `NGM_FLOW_COOKIE` handler of the
netgraph7 `ng_tee` node type (`sys/netgraph7/tee/ng_tee.c:263-264`).
When a `NGM_FLOW_COOKIE` control message is addressed by node name (no
hook segment in the path), `lasthook` is NULL. If the tee node's `left`
and `right` hooks were never connected, `sc->left.hook==NULL` and
`sc->right.hook==NULL`, so `NULL==NULL` is TRUE and
`NG_HOOK_PRIVATE(NULL)` dereferences NULL → kernel panic.

## Reachability

- **Root-only**: AF_NETGRAPH control socket requires
  `caps_priv_check(SYSCAP_RESTRICTEDROOT)`.
- **Netgraph7 required**: the bug is in `sys/netgraph7/tee/ng_tee.c`.
  The default DragonFly netgraph (`sys/netgraph/`) does not have this code.
  Netgraph7 is opt-in (load the netgraph7 KLD modules).

## Impact

Deterministic kernel panic (local DoS, root → kernel). No escalation
(NULL deref = read, no write primitive). Low severity.

## How to reproduce

### Prerequisites

1. Build and load the netgraph7 modules from `sys/netgraph7/`:
   ```
   cd /usr/src/sys/netgraph7/netgraph && make && kldload ./netgraph.ko
   cd /usr/src/sys/netgraph7/socket && make && kldload ./ng_socket.ko
   cd /usr/src/sys/netgraph7/tee    && make && kldload ./ng_tee.ko
   ```
   Verify: `sysctl net.graph.msg_version` should print `8`.

2. Build the PoC:
   ```
   ./build.sh
   ```

3. Run as root:
   ```
   ./run.sh
   ```

### Expected output (bug present)

```
[+] opened AF_NETGRAPH control socket (fd=3)
[+] mkpeer tee left2right<->left2right  (left/right hooks NOT connected)
[+] named the tee node 'tee0'
[+] sending NGM_FLOW_COOKIE to 'tee0:' (addressed by name => lasthook=NULL)
[+] EXPECT: kernel panic / fatal trap 12 (page fault) in ng_tee_rcvmsg
(ssh dies — kernel panicked)
```

Serial console shows:
```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x20
Stopped at ng_tee_rcvmsg+0x83: movq 0x20(%rdx),%rax
```

### Expected output (bug fixed)

```
[+] sending NGM_FLOW_COOKIE to 'tee0:' ...
[?] sendto returned without panic -> bug NOT triggered on this kernel
RUN_EXIT=0
```

## Files

- `ng_tee_flow_nullderef.c` — the PoC (raw sendto, netgraph7 struct layout)
- `build.sh` / `run.sh` — build and run scripts
- `fix.diff` — the one-line fix (`lasthook != NULL &&` guard)
- `VERDICT.md` — detailed analysis
- `panic.txt` / `panic_full.txt` — panic signature from boot.log
- `env.txt` — guest environment
- `run.log` / `build.log` — run and build logs
- `manifest.json` — artifact catalog