# DF-0748 — Unchecked uint16_t index into 10-element `log_if_table[]`

**Status:** REPRODUCED (panic via harness). **Impact:** latent panic / OOB-read primitive; root-only reachability; dead code on default kernel.

## Quick repro (on the DragonFly guest as root)

```sh
sh /root/poc748/run.sh
# unpatched kernel: guest panics in bpf_mtap+0x79 (Fatal trap 9 GPF)
# patched kernel:  trigger runs to completion, guest stays up
```

## Files in this folder

| file | what it is |
|---|---|
| `trigger.sh`      | minimal root-only trigger: load ipfw3, set verbose, install `log N` rule, ping |
| `run.sh`          | end-to-end repro: builds+loads the harness kld, then runs the trigger |
| `harness/harness.c` | 30-line kld that wires `ip_fw3_log_ptr = ip_fw3_log` (the registration upstream never finished) |
| `harness/Makefile` | builds `df748_wire_log.ko` |
| `harness/wire.sh` | build+load the harness |
| `fix.diff`        | git-apply-able fix: `if (id >= LOG_IF_MAX) return;` at top of `ip_fw3_log()` |
| `VERDICT.md`      | full narrative (mechanism, primitive, why no escalation, fix validation) |
| `panic.txt`       | the panic signature captured from `boot.log` (proof of crash) |
| `fix_build.log`   | full build output of the patched `ipfw3_basic.ko` |
| `fix_run.log`     | full output of the trigger on the patched module (no panic) |
| `env.txt`         | guest uname, cc, kldstat, sysctls at test time |

## Read `VERDICT.md` for the full story.

In short:
- The bug is real: `ip_fw3_log.c:121` indexes `log_if_table[10]` with an unchecked `uint16_t id`.
- The bug is unreachable from packet processing on a default kernel because `ip_fw3_log_ptr` (the only call-site gate) is initialised NULL at `ip_fw3.c:134` and never assigned anywhere in `sys/`.
- The harness module proves the primitive by wiring the pointer; the trigger then causes a deterministic `Fatal trap 9` in `bpf_mtap+0x79`.
- Even if the path were live, the bug is **root-only**: installing any ipfw3 rule requires `SYSCAP_NONET_RAW` (raw IP socket) per `raw_ip.c:473`. No unprivileged→root escalation exists.
- The fix is a one-line bounds check; it is validated by a module-only rebuild (deterministic panic before, no panic after, 3/3 runs).