⬢ DragonFlyBSD Kernel Audit
DF-3357 / fix_validation.log
← back to finding ↓ download raw
# DF-3357 fix validation (single-fix kernel)
# fix.diff applied to guest /usr/src/sys/netinet/udp_usrreq.c
#   cd /usr/src && patch -p1 -s -N < /tmp/fix.diff
#   make -j4 nativekernel KERNCONF=X86_64_GENERIC   -> BUILD-EXIT=0
#   make installkernel KERNCONF=X86_64_GENERIC      -> INSTALL-EXIT=0
#   reboot
fix_kernel_uname: DragonFly dfbsd 6.5-DEVELOPMENT #1: Fri Sep 11 08:24:42 UTC 2026

## BASELINE (stock kernel #0, Thu Jul 2 06:02:54 UTC 2026) — same PoC:
  trigger (specific-bound, 2-byte sockaddr): "datagrams output" 1088 -> 1138 (+50)
  control  (wildcard-bound, 2-byte sockaddr): 1088 -> 1088 (+0)
  tcpdump vtnet0: IP 10.0.2.15.1494 > 255.255.255.255.65535: UDP, length 1  (x50)
  => REPRODUCED (heap-derived destination emitted on the wire)

## PATCHED (kernel #1 with fix.diff) — identical PoC:
  trigger (specific-bound, 2-byte sockaddr): "datagrams output" 0 -> 0 (+0)
  normal-path regression (16-byte sockaddr to 127.0.0.1:9999):
      sendto rc=1; tcpdump lo0: IP 127.0.0.1.4020 > 127.0.0.1:9999: UDP, length 1
      => normal datagram path unaffected

## Conclusion: the 2-byte-sockaddr sendto no longer emits any packet (rejected
  before any field beyond sa_family is read); normal sends work. FIX VALIDATED.