{
  "finding_id": "DF-3045",
  "title": "bootp trusts interface sdl_alen without bounding it to chaddr[16]/hexstr[64]",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "on the guest: sh build.sh  (sha256-gates bootp_subr.c to the audited tree, compiles the verbatim source via the harness into the kernel; reboot)",
    "run": "sysctl -w kern.dfrig12=3 (fake IFT_ETHER ifaddr with sdl_alen=17 through verbatim fakeup/compose/call); kern.dfrig12=5 (contained hexncpy canaries: alen=22 and 106 as-shipped form, bounded form); on a dedicated boot kern.dfrig12=50 (in-situ alen=255, fatal)",
    "expected": "test 3 baseline: selection ACCEPTED sdl_alen=17; call.hlen=17; bcopy overran chaddr[16] by 1 byte (call.sname[0]=0x50==MAC[16]); matcher bcmp len=17 reads 1 byte past chaddr[15] on both sides; exchange completes error=0. test 5: 2 bytes past the 64-byte buffer at alen=22, 254 bytes past at alen=106, 0 with the bounded form. test 50: Fatal trap 9 GPF at bootpc_call+0x83d ret with frame pointer 0x3a37363a36363a35 (0x3a = the hexncpy separator). Fixed kernel test 3: selection REJECTED, verbatim panic bootpc: Unable to find HW address for fak0."
  },
  "kernel_refs": [
    "sys/vfs/nfs/bootp_subr.c:1046-1053",
    "sys/vfs/nfs/bootp_subr.c:1192",
    "sys/vfs/nfs/bootp_subr.c:1197",
    "sys/vfs/nfs/bootp_subr.c:846-848",
    "sys/vfs/nfs/bootp_subr.c:718-720",
    "sys/vfs/nfs/bootp_subr.c:590",
    "sys/vfs/nfs/bootp_subr.c:102",
    "sys/sys/libkern.h:67",
    "sys/libkern/hexncpy.c:56-62",
    "sys/net/if_ethersubr.c:620",
    "sys/net/if_ethersubr.c:647"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig12_bootp.c", "build.sh", "run.sh",
    "run.log", "run50.log", "run.fixed.log", "panic.txt",
    "panic50_console_full.txt", "panic_fix_rejection_console.txt",
    "fix_validation.log", "fix.diff", "fix_combined.diff",
    "build.log", "build_fixed.log", "env.txt", "manifest.json", "verdict.json"
  ]
}