⬢ DragonFlyBSD Kernel Audit
DF-3287 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-3287",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Single 54-byte AE=01 unicast DSTODS QoS mesh data frame from an established peer panics the stock INVARIANTS kernel with panic: no route at the inlined mesh_recv_indiv_data_to_fwrd KASSERT (mesh_input+0x127b); on non-INVARIANTS builds the same path calls ieee80211_mesh_rt_update(NULL) whose MESH_RT_ENTRY_LOCK writes near NULL. Root cause: mesh_checkpseq only ensures a route for the AE-specific SA while to_fwrd/to_me deref a route for i_addr4 unconditionally.",
  "exploit_chain": "attacker beacon -> victim auto-peers (OPENSNT) -> synchronous OPEN+CONFIRM -> ESTABLISHED -> one crafted AE=01 4-address unicast data frame (addr4 = never-routed MAC, addr3 = the mc_addr4 the seq-check routed) -> rt_find(i_addr4) == NULL -> KASSERT panic (INVARIANTS) / near-NULL lockmgr write (production) -> remote DoS",
  "evidence": "panic.txt: full console trace (panic: no route, mesh_input+0x127b)\nREADME.md root-cause cites mesh.c:1758-1768, 1441-1444, 1482-1488",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:1441",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:1442",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:1482",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:1488",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:1758"
  ],
  "poc_changes": "shared harness fwm.c (DF-3286 pack); step 11 crafts the AE=01 frame with addr3==mc_addr4 so the rt_meshda lookup passes and the NULL rt_meshsa deref is reached",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 1,
  "build_cmd": "sh findings/poc/DF-3286/build.sh",
  "run_cmd": "sh findings/poc/DF-3287/run.sh",
  "code_hash": "1b0e0b1a43331b1bc92e2614476535a88b88d3863db6ef91a36eead5c8ad7503",
  "notes": "guest wedged in ddb after panic; reset with-src performed",
  "recommended_fix": "NULL-check the addr4 route in to_fwrd/to_me and discard the frame instead of KASSERT+deref (fix.diff hunks 2-3)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 05:34:08 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix kernel)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "same single AE=1 frame that panicked the stock kernel (panic: no route) is silently discarded on the fixed kernel (NO_PANIC_3287); link stays established",
  "fix_evidence": [
    "fix.log: NO_PANIC_3287"
  ]
}