# DF-2452 — dm_target_flakey NULL-deref via mismatched feature_cnt

## Verdict

**REPRODUCED (panic / local DoS) + FIX VALIDATED.** The bug is real and
deterministically crashes the kernel when a flakey table is reloaded with a
`feature_cnt` parameter that claims more feature args than actually follow in
the params string. `_init_features` trusts this count and walks past the
populated argv slots into the M_ZERO'd NULL tail, dereferencing NULL in
`strcmp` → page-fault panic. The escalation to `uid=0` is **blocked by a valid
hard blocker**: this is a pure NULL-deref (read fault at VA 0x0) with **no
write primitive**, and the dm control device is root/operator-only. Realistic
impact ceiling: **local DoS** (root/operator can panic the kernel). The
authored `fix.diff` is built as a single-fix `dm_target_flakey.ko` module,
installed, and confirmed to close the bug (panic → clean `EINVAL`).

## Mechanism (trigger → primitive → effect)

`_init_features()` in `sys/dev/disk/dm/flakey/dm_target_flakey.c`:

```c
 122: static int
 123: _init_features(dm_target_flakey_config_t *tfc, int argc, char **argv)
 124: {
 125:     char *arg;
 126:     unsigned int value;
 127:
 128:     if (argc == 0)
 129:         return 0;
 130:
 131:     argc = atoi64(*argv++);  /* # of args for features */
 132:     if (argc > 6) {          /* upper-bound check ONLY */
 133:         kprintf("Invalid # of feature args %d\n", argc);
 134:         return EINVAL;
 135:     }
 136:
 137:     while (argc) {
 138:         argc--;
 139:         arg = *argv++;       /* <-- walks past populated slots */
```

* `dm_table_init` (`sys/dev/disk/dm/dm_ioctl.c:824`) allocates `argv` with
  `kmalloc(sizeof(*argv) * n, M_DM, M_WAITOK | M_ZERO)` and fills only the
  parsed tokens; the rest stay NULL.
* `dm_target_flakey_init` (`dm_target_flakey.c:108`) calls
  `_init_features(tfc, argc - 4, argv + 4)` where `argc - 4` is the number of
  feature args actually present.
* `_init_features` immediately overwrites its `argc` parameter with the count
  embedded in the FIRST feature arg (`atoi64(*argv++)`). The original argc
  parameter is lost — there is **no check** that the declared count <= the
  actual remaining args.
* When the declared count exceeds the actual remaining args, the `while`
  loop reads `*argv++` past the populated slots into the NULL tail. The next
  `strcmp(arg, "drop_writes")` (or `strcmp(arg, "corrupt_bio_byte")`)
  dereferences NULL → kernel page fault.

### Trigger

params: `<dev> <offset> <up_int> <down_int> 5 drop_writes`

The `5` is the declared feature_cnt, but only ONE feature arg (`drop_writes`)
follows. After consuming "drop_writes" (iteration 1), iteration 2 reads
`argv[6]` which is NULL → `strcmp(NULL, ...)` → panic.

### Observed crash signature (boot.log)

```
Fatal user address access from kernel mode from poc at ffffffff809d75cc
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x0
fault code         = supervisor read data, page not present
Stopped at      strcmp+0xc:     movzbl  (%rdi,%rax,1),%edx
db>
```

Fault VA `0x0`, stopped at `strcmp+0xc` with `%rdi==0` (NULL) — exactly the
NULL-deref from reading a zeroed argv slot.

## Privilege analysis — why this is DoS, not privesc

1. **Module load:** reaching the dm ioctl requires `kldload dm`, root-only.
2. **Device node:** `/dev/mapper/control` is `0640 root:operator`
   (`device-mapper.c:181`). The `maxx` user (uid 1001) gets EACCES.
3. The primitive is a **read-fault-equivalent NULL deref** — no
   attacker-controlled bytes are written before the trap. There is **no
   corruption to groom**, so no escalation chain.

This is the valid hard blocker for Phase 6.

## Exploit chain

`none` — pure NULL-deref panic, no write primitive (valid hard blocker).

## Fix (`fix.diff`)

Save the original argc parameter before overwriting it. After reading the
declared feature count, validate it against the actual remaining args:

```c
int avail;

if (argc == 0)
    return 0;

avail = argc - 1;  /* remaining args after consuming the count */
argc = atoi64(*argv++);  /* # of args for features */
if (argc > 6 || argc > avail) {
    kprintf("Invalid # of feature args %d (available %d)\n", argc, avail);
    return EINVAL;
}
```

## Fix validation (Phase 8)

1. **Baseline** (`with-src` snapshot, kernel `6.5-DEVELOPMENT #0`,
   unpatched `dm_target_flakey.ko`): PoC panics deterministically —
   `Fatal trap 12`, fault VA `0x0`, `Stopped at strcmp+0xc`. Guest in DDB.
2. **Patched**: applied `fix.diff` to
   `/usr/src/sys/dev/disk/dm/flakey/dm_target_flakey.c`, built the module
   alone (`make` in `sys/dev/disk/dm/flakey`), installed
   `dm_target_flakey.ko` → `/boot/kernel/dm_target_flakey.ko`, reloaded.
3. **Re-run**: same PoC returns `EINVAL` (errno 22) —
   `reload ioctl returned rv=22 (Invalid argument)`. Guest stays up.
4. Verdict: **fix closes the bug** (panic → clean EINVAL).

## PoC

`poc.c` — libprop `NETBSD_DM_IOCTL`:
1. `command="create"`, `name="df2452dev"`.
2. `command="reload"` with target type `"flakey"` and params
   `/dev/md0 0 10 5 5 drop_writes` (feature_cnt=5 but only 1 arg follows).

Build: `cc -O2 -o poc poc.c -lprop`
Run (as root, after `kldload dm; kldload dm_target_flakey`): `./poc`