{
  "finding_id": "DF-3355",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "config_red() copies ioc_fs->lookup_step into the flowset without any validation (ip_dummynet3.c:1374). When a RED flowset with lookup_step==0 has a flow queue that goes idle with a non-zero average and then receives one more packet, red_drops() executes u_int t = (curr_time - q->q_time) / fs->lookup_step (:904) -> integer divide fault. Reproduced 1/1 on the stock guest: Fatal trap 18: integer divide fault, Stopped at dummynet_io+0x8c2: divq %rsi,%eax (red_drops is inlined into dummynet_io); the only #DE-capable division reachable in that function under this config is the lookup_step one (fs weight is 1). Trigger: RED fs (w_q=65536 so avg jumps to SCALE(1) on the 2nd packet), 3 packets to build avg>0, wait for the queue to empty, one more packet. Identical code to v1 DF-0375 (sys/net/dummynet/ip_dummynet.c); missed by pass-1 of this file (DF-0382 only covers config_reds own max_th/(max_th-min_th) divisions).",
  "exploit_chain": "root: setsockopt pipe{slow} + fs{DN_IS_RED, w_q=65536, lookup_step=0, mask dst-port}; 3 quick UDP pkts to one flow (3rd sees q_size!=0 -> avg>0), 1 pkt to a second flow (keeps scheduler busy so the idle-flush at :614 cannot mark/expire the victim queue), wait 200ms, 1 more pkt to the first flow -> red_drops q_size==0 && avg!=0 branch -> divq by zero -> panic. No uid=0.",
  "evidence": [
    "panic.txt: Fatal trap 18 integer divide fault, dummynet_io+0x8c2 divq %rsi,%eax",
    "run.log: RED config + 5-packet choreography transcript",
    "dfv3.c: redzero subcommand"
  ],
  "kernel_refs": [
    "sys/net/dummynet3/ip_dummynet3.c:1374",
    "sys/net/dummynet3/ip_dummynet3.c:904",
    "sys/net/dummynet3/ip_dummynet3.c:1108"
  ],
  "poc_changes": "PoC authored fresh (multi-trigger dfv3.c): raw setsockopt with ABI structs verbatim from ip_dummynet3.h; ipfw3 (not ipfw) `queue <fs> udp ... via lo0` rules divert lo0 UDP into the WF2Q path; setup.sh sets net.filters_default_to_accept=1 before kldload ipfw3 because ipfw3 defaults to deny-all and otherwise locks out ssh.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "in-guest root: cc -O -o /tmp/dfv3 /tmp/dfv3.c",
  "run_cmd": "in-guest root: sh /tmp/setup.sh && /tmp/dfv3 redzero",
  "code_hash": "9f8b5ab161a2890df06ccaf75ed7ddbbb746efb2f2320c50d209317fe5b42c09",
  "notes": "dummynet3.ko + ipfw3.ko + ipfw3_basic.ko kldloaded; triggers are UDP to 127.0.0.1 matched by ipfw3 queue rules. Panic findings verified once each on the stock INVARIANTS kernel; DF-3356 verified with control run. v1 twin (sys/net/dummynet/ip_dummynet.c) carries the same code.",
  "recommended_fix": "sanitize lookup_step<1 to 1 in config_red (fix.diff hunk 5)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Fri Sep 11 07:37:10 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64 (dummynet3 fix.diff applied, rebuilt via make nativekernel)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Union fix.diff (all five DF-3352..DF-3356 hunks; this findings hunk is the one noted in recommended_fix) applied to the guest /usr/src, kernel rebuilt with make -j6 nativekernel KERNCONF=X86_64_GENERIC and installed (>>> Kernel build completed 07:41:12, install completed 07:42:30 UTC). config_red sanitizes lookup_step<1 to 1: redzero trigger survives 8s with no divide fault (baseline: Fatal trap 18 in dummynet_io+0x8c2 on the 5th packet). All other four PoCs re-run on the same patched kernel: all clean.",
  "fix_evidence": [
    "run.2.log (patched-kernel validation transcript)",
    "fix.diff (git-apply-able unified diff, 6 hunks vs sys/net/dummynet3/ip_dummynet3.c)"
  ]
}