DF-3357 / fix_validation.log
# DF-3357 fix validation (single-fix kernel)
# fix.diff applied to guest /usr/src/sys/netinet/udp_usrreq.c
# cd /usr/src && patch -p1 -s -N < /tmp/fix.diff
# make -j4 nativekernel KERNCONF=X86_64_GENERIC -> BUILD-EXIT=0
# make installkernel KERNCONF=X86_64_GENERIC -> INSTALL-EXIT=0
# reboot
fix_kernel_uname: DragonFly dfbsd 6.5-DEVELOPMENT #1: Fri Sep 11 08:24:42 UTC 2026
## BASELINE (stock kernel #0, Thu Jul 2 06:02:54 UTC 2026) — same PoC:
trigger (specific-bound, 2-byte sockaddr): "datagrams output" 1088 -> 1138 (+50)
control (wildcard-bound, 2-byte sockaddr): 1088 -> 1088 (+0)
tcpdump vtnet0: IP 10.0.2.15.1494 > 255.255.255.255.65535: UDP, length 1 (x50)
=> REPRODUCED (heap-derived destination emitted on the wire)
## PATCHED (kernel #1 with fix.diff) — identical PoC:
trigger (specific-bound, 2-byte sockaddr): "datagrams output" 0 -> 0 (+0)
normal-path regression (16-byte sockaddr to 127.0.0.1:9999):
sendto rc=1; tcpdump lo0: IP 127.0.0.1.4020 > 127.0.0.1:9999: UDP, length 1
=> normal datagram path unaffected
## Conclusion: the 2-byte-sockaddr sendto no longer emits any packet (rejected
before any field beyond sa_family is read); normal sends work. FIX VALIDATED.