# DF-3366 — VERDICT

**Status: reproduced (unprivileged local kernel heap info leak).**
**Impact: leak — uninitialized/stale kernel heap bytes disclosed to any local
user via PF_ROUTE RTM_GET.**
**Confidence: certain.**

## Root cause

1. `rt_setgate()` (sys/net/route.c:1182, 1213-1223) allocates the route's
   key+gateway chunk with `dlen = RT_ROUNDUP(dst->sa_len)` and
   `glen = RT_ROUNDUP(gate->sa_len)` — rounded lengths.
2. `rtrequest1()` RTM_ADD/RTM_RESOLVE then initializes the key with only
   `sa_len` valid bytes:
   * route.c:925 `bcopy(dst, ndst, dst->sa_len)` — nothing initializes
     `[sa_len, RT_ROUNDUP(sa_len))`;
   * route.c:922 `rt_maskedcopy()` — zeroes only up to `cplim2 = dst +
     src->sa_len` (route.c:1295, 1303-1304), again not to the rounded bound.
   The gateway is copied with the *rounded* length `glen` (route.c:1227),
   which also reads up to 7 bytes past the source sockaddr's valid content
   when the adding message's final sockaddr is unpadded (rtsock.c:1023
   checks `cp + sa->sa_len > cplim`, not the rounded bound).
3. `rt_msg_buffer()` (sys/net/rtsock.c:1134-1143) copies
   `RT_ROUNDUP(sa->sa_len)` bytes of every sockaddr into the reply mbuf
   that is delivered to routing sockets.
4. `route_output()` privilege check (rtsock.c:738-740) exempts `RTM_GET` —
   any local user can read the padded bytes.

Consequence: for any route whose key/gateway family has `sa_len % 8 != 0`
(AF_INET6: 28 → 4-byte tail; AF_LINK/AF_MPLS: variable), 1-7 stale heap
bytes per sockaddr are disclosed. The bytes are *recycled M_RTABLE slab
content* — i.e. fragments of previously freed routing objects.

## How it was reproduced (guest `DragonFly dfbsd 6.5-DEVELOPMENT #0 ... X86_64_GENERIC`)

* Baseline: unprivileged `RTM_GET ::1` — pads `00 00 00 00` (boot-time slab
  came from zeroed pages; leak content is benign here, the disclosure channel
  is nonetheless exercised) — `run.baseline.log`.
* Groom (root): 32 RTM_ADDs of host routes with a `sockaddr_in6` carrying
  `sin6_len = 32` and marker `41 42 43 44` at bytes [28..32). `sin6_len` is
  never validated against the family template, so `rtrequest1` copies all 32
  bytes into the 64-byte key chunk (`bcopy(dst, ndst, dst->sa_len)`).
  EEXIST-failed adds also work: the chunk is allocated and freed on the error
  path (route.c:976). Then 32 RTM_DELETEs free the marker chunks; one victim
  route with a normal `sin6_len = 28` sockaddr is added and reuses a chunk
  from the same M_RTABLE size class — its key tail is the stale marker.
* Decisive read: unprivileged user `maxx` (uid 1001) `RTM_GET
  2001:db8:99::1` → DST pad `41 42 43 44`, 5/5 identical runs (`run.log`).

This proves **cross-object stale kernel heap disclosure**: bytes written by
one (privileged) routing operation into a *freed* kernel allocation surface,
unmodified, in another object's route entry, readable by an unprivileged
user. On a multi-user host any user can silently harvest fragments of freed
routing state (addresses, labels, malloc metadata) and, with route churn,
recycled kernel heap generally.

## Notes / adjacent surface (same consumer, not fixed here)

* The `RTA_IFP/RTA_IFA` sockaddrs filled by `_fillrtmsg` are also copied out
  rounded: the link-level `sockaddr_dl` is allocated pre-rounded
  (sys/net/if.c:568, `sdl_len = socksize`), AF_INET is 16 bytes — no tail;
  embedded AF_INET6 ifaddr sockaddrs expose 4 adjacent struct bytes
  (in-allocation, structured data, not stale heap).
* `rt_msg_mbuf()` (rtsock.c:1157+, route-change broadcasts) has the same
  rounded copy; those messages are delivered to all routing sockets.

## Fix validation

* `fix.diff` (in this pack): zero the key padding in `rtrequest1` after the
  key copy, and copy/zero the gateway by exact `sa_len` (also removes the
  ≤7-byte over-read of the source sockaddr). Authored against the read-only
  `sys/` tree; applied to the guest's `/usr/src` copy only.
* Procedure: `vm.sh` guest, `cd /usr/src && patch -p1 < fix.diff && make -j6
  nativekernel KERNCONF=X86_64_GENERIC`, reboot into the patched kernel
  (uname recorded in `fix_validation.log`), re-ran the exact PoC.
* Baseline (stock kernel): DST pad `41 42 43 44`.
* Patched kernel: DST pad `00 00 00 00` — leak gone; groom/victim still
  succeed (route add works, so no functional regression).
* `fix_status: fixed`.

## Known-findings cross-reference (pass 2)

* DF-0397/DF-0398 (rt_setshims): **still unfixed** in this tree; note the
  leak component is broader than the partial-alloc case — `rtfree()`
  (route.c:299-307) and the RTM_DELETE path never free `rt_shim[0..2]` at
  all, so *every* MPLS route deletion leaks its shims.
* DF-0399 (rtredirect ignores rt_setgate): **still unfixed**.
* DF-0400 (rt_fixchange mask OOB): **still unfixed**, still latent (radix
  allocates masks key-sized; no new trigger path found).
* DF-3358 (rtmask_add_global pollution): **still unfixed**; confirmed there
  is *no free path* for the per-CPU route mask trees — `rn_freemask` is only
  called for pf's mask head (sys/net/pf/pf_ioctl.c:3402), so pollution is
  permanent for the lifetime of the booted kernel.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.