{
  "finding_id": "DF-3292",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "mesh_ioctl_set80211 passes the raw user-supplied ireq->i_data pointer to ieee80211_mesh_rt_del (mesh.c:3663) and to IEEE80211_ADDR_EQ pre-checks (:3654) with no copyin; the DELETE path dereferences it in-kernel (memcmp at :377). Seeding one route via MESH_RTCMD_ADD then issuing DELETE with i_data=0xffffffff40000000 faults the kernel: Fatal trap 12, supervisor read, fault VA 0xffffffff40000000, stopped at bcmp+0x3c (see panic.txt). Privileged-only (SIOCS80211 requires SYSCAP_NONET_WIFI): local DoS plus an arbitrary-kernel-address 6-byte read oracle (route-deleted vs not is observable).",
  "exploit_chain": "privileged process: ioctl ADD (valid buffer) seeds a route -> ioctl DELETE with i_data = chosen kernel address -> kernel memcmp(rt_dest, kernel_addr, 6) -> page fault panic on unmapped address, or a 6-byte equality oracle (deletes route on match) on mapped addresses",
  "evidence": "panic.txt: Fatal trap 12, fault VA 0xffffffff40000000, Stopped at bcmp+0x3c",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:3654",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:3663",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:377"
  ],
  "poc_changes": "tool first seeds a route via the ADD ioctl (empty table skips the loop entirely), then DELETEs with an unmapped kernel address; first address choice 0xffffffff81234000 did not fault (mapped), 0xffffffff40000000 does",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 05:34:08 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix kernel; ioctl path untouched by fix.diff)",
  "runtime_sec": 300,
  "guest_dirty": 1,
  "build_cmd": "cc -O -o /root/fwm/setmeshdel /root/fwm/setmeshdel.c (in guest)",
  "run_cmd": "sh findings/poc/DF-3292/run.sh",
  "code_hash": "d61a4f41b2b128b9ccdcd4b65d8235fa8fc27972835dbbbe677897a7418b57a4",
  "notes": "guest reset (clean snapshot) performed after the panic; requires a live mesh vap with >=1 route",
  "recommended_fix": "copyin(ireq->i_data, tmpaddr, IEEE80211_ADDR_LEN) once at the top of the RTCMD case and use tmpaddr for both the EQ checks and rt_del",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "no fix authored for this Low finding in the combined kernel (one-line copyin fix in the recommended_fix)",
  "fix_evidence": []
}