{
  "finding_id": "DF-3045",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "The unvalidated sdl_alen chain was reproduced end to end through the verbatim production code on the guest kernel: bootpc_fakeup_interface at :1046-1053 accepted an IFT_ETHER link address with sdl_alen=17 with no length check; bootpc_compose_query set call.hlen=17 (:1192) and the bcopy at :1197 overran chaddr[16] by one byte into call.sname[0] (byte-identical attribution to the 17th MAC byte); the reply matcher bcmp at :846-848 compared 17 bytes, reading past the 16-byte chaddr member on both sides, and the full BOOTP exchange completed. The hexncpy call at :718-720 with HEX_NCPYLEN(alen)=alen*3 against char hexstr[64] (:590) was measured with guard canaries (2 bytes past at alen=22, 254 at alen=106, scaling to 701 past at alen=255) and driven in situ through verbatim bootpc_call with sdl_alen=255, producing a fatal kernel GPF at bootpc_call+0x83d ret with frame pointer 0x3a37363a36363a35, i.e. saved control flow overwritten with the 0x3a separator bytes of hexncpy. Real-world reachability remains driver-gated exactly as the finding states: every in-tree Ethernet interface gets sdl_alen=6 from ether_ifattach (if_ethersubr.c:620,647) and no unprivileged path can present an over-long IFT_ETHER address, so no uid0 route exists on this guest; what the run upgrades from speculative to certain is the primitive itself, including full-magnitude boot-time kernel stack corruption once such a driver exists. Fix validation A/B caught and corrected a bug in the first proposed hunk (appending predicates to the sdl assignment leaves sdl non-NULL on rejection); the corrected fix.diff rejects alen outside 1..16 at selection (verbatim loud panic Unable to find HW address) and bounds the hexncpy outlen with sizeof(hexstr), after which none of the cited uses can observe alen above 16.",
  "exploit_chain": "broken or virtual driver attaches an IFT_ETHER ifaddr with sdl_alen above 16 (no in-tree driver does; ether_ifattach forces 6) -> verbatim selection at :1046-1053 accepts it -> compose_query bcopy at :1197 overruns chaddr[16] into sname/file/vend of the outgoing query and hlen at :1192 drives an in-struct bcmp overread at :846-848 -> hexncpy at :718-720 writes 3*alen bytes from hexstr[64] in the bootpc_call stack frame -> saved registers and return address overwritten with hex and colon bytes -> fatal GPF on return (observed) or, on an unhardened target, potential control-flow hijack at boot",
  "evidence": "run.log: selection ACCEPTED sdl_alen=17, chaddr hexdump 40..50 spilling into sname, bcmp len=17 with 1 byte past chaddr[15], error=0; run50.log + panic.txt: Fatal trap 9, frame pointer 0x3a37363a36363a35, Stopped at bootpc_call+0x83d ret; canary lines 2 bytes past (alen=22) and 254 bytes past (alen=106); run.fixed.log + panic_fix_rejection_console.txt: selection REJECTED and verbatim panic bootpc: Unable to find HW address for fak0 with backtrace through bootpc_fakeup_interface",
  "kernel_refs": [
    "sys/vfs/nfs/bootp_subr.c:1046-1053",
    "sys/vfs/nfs/bootp_subr.c:1192",
    "sys/vfs/nfs/bootp_subr.c:1197",
    "sys/vfs/nfs/bootp_subr.c:846-848",
    "sys/vfs/nfs/bootp_subr.c:718-720",
    "sys/vfs/nfs/bootp_subr.c:590",
    "sys/vfs/nfs/bootp_subr.c:102",
    "sys/sys/libkern.h:67",
    "sys/libkern/hexncpy.c:56-62",
    "sys/net/if_ethersubr.c:620",
    "sys/net/if_ethersubr.c:647"
  ],
  "poc_changes": "no seed PoC existed (finding was marked not testable on the audit guest); built the verbatim-interposition rig with a fake ifnet whose only AF_LINK ifaddr is a crafted sockaddr_dl; fixed two harness bugs found during the run (missing gctx->starttime made the BOOTP_TIMEOUT knob fire early; separate static canary arrays were reordered by the linker, merged into one struct for guaranteed adjacency); first proposed selection hunk was itself buggy and was corrected after the A/B run caught it still accepting alen=17",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #2 Tue Oct 20 14:47:53 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline decisive boot); fixed decisive boot #2 Tue Oct 20 16:53:09 UTC 2026",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (sha256 gate + make -j6 nativekernel KERNCONF=X86_64_GENERIC + make installkernel)",
  "run_cmd": "sysctl -w kern.dfrig12=3; sysctl -n kern.dfrig12_status; kern.dfrig12=5; dedicated boot: kern.dfrig12=50",
  "code_hash": "f017052c0ccd052813c7dabfb13ea4ec0b7e28046308beef1dbef707102b9902",
  "notes": "impact recorded as panic because the in-situ run fatally trapped the guest kernel with control-flow-corrupting stack overwrite (frame pointer consisting of hexncpy separator bytes); reachability stays hardware/driver-gated (finding severity Low, speculative reach) since no in-tree driver presents IFT_ETHER with alen above 6 and net/if.c:2885 refuses sdl_alen changes for existing interfaces. Fixed source sha256 52154f24f8d0f6fd8964d8cab366e81a377c5c10c622a7b3531c293d33be0148.",
  "recommended_fix": "accept a link address only when 0 < sdl_alen <= sizeof(call.chaddr) at the bootpc_fakeup_interface selection (assigning the local sdl pointer only when all predicates hold) and pass sizeof(hexstr) as the hexncpy outlen (validated in fix.diff)"
}