{
  "finding_id": "DF-3368",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "nm_bdg_preflush (netmap_vale.c:984-1016) only batch-limits ft_i at packet completion, so NS_MOREFRAG chains (user-writable slot->flags, never validated) run ft_i to the full ring size (<=4096) against the 1088-entry nkr_ft table (52104-byte kmalloc). Proven in-kernel with the verbatim function in a KLD on the stock INVARIANTS kernel: (1) 13418 attacker-data bytes written past the ft[] contract at ft[1088..2046]; (2) with the verbatim nm_alloc_bdgfwd allocation, writes 680 bytes PAST the heap object at ring=3300 (up to 13416 past at 4096), guest surviving = silent corruption; (3) all-MOREFRAG batches make netmap_vale.c:1013 store ft[ft_i-frags].ft_frags with index -1 (u_int) -> wild write at ft+0xFFFFFFF8, observed Fatal trap 12 at exactly that store; (4) a 256-frag chain truncates into uint8_t ft_frags=0 so nm_bdg_flushs pass-1 walk (netmap_vale.c:1161) never advances - proven livelock. Each entry carries attacker-chosen u16 len/flags and, via NS_INDIRECT, an arbitrary 64-bit pointer (ft_buf=slot->ptr). uid=0 chain not developed: netmap does not compile on this platform (netmap_kern.h:747 if_unused7 rot; no module, no /dev/netmap) - exploitation unreachable on this guest, documented as the hard blocker; the primitive is fully characterized for platforms where the in-tree code builds.",
  "exploit_chain": "open /dev/netmap -> NIOCREGIF vale port with nr_tx_slots up to NM_BDG_MAXSLOTS=4096 -> mmap ring -> set slot[j].flags=NS_MOREFRAG|NS_INDIRECT, slot[j].ptr=arb, slot->len=arb, ring->cur=ring-1 -> ioctl(NIOCTXSYNC) -> bdg_netmap_txsync -> netmap_vp_txsync -> nm_bdg_preflush: linear heap overflow past nkr_ft (10 controlled bytes + arbitrary 64-bit pointer per 16B entry, index fully chosen), plus post-loop +4GiB wild byte-write, plus flush livelock. Escalation on this guest: blocked (subsystem dead code here).",
  "evidence": "run.log: max table index written: 2046, OVER NM_BDG_BATCH_MAX=1088 + CANARY bytes corrupted past ft[] contract: 13418, first @ft+17408 (ft[1088]); mode 3: byte offset 52784 PAST alloc size 52104 on a real kmalloc(52104); run.crash.log: Fatal trap 12 ... fault virtual address = 0xfffff81118640038 (= ft+0xFFFFFFF8) Stopped at df3368_sysctl+0x401: movb %dl,0x8(%r8,%rax,1) = netmap_vale.c:1013 store; mode1 ft[0].ft_frags = 0 (256 truncated to uint8_t) + pass-1 walk STUCK at i=0; fixed-variant A/B in run.log (idx<=1023, canary 0, walk terminates).",
  "kernel_refs": [
    "sys/net/netmap/netmap_vale.c:984-1016",
    "sys/net/netmap/netmap_vale.c:994-995",
    "sys/net/netmap/netmap_vale.c:1004",
    "sys/net/netmap/netmap_vale.c:1006",
    "sys/net/netmap/netmap_vale.c:1012-1013",
    "sys/net/netmap/netmap_vale.c:1161",
    "sys/net/netmap/netmap_vale.c:124",
    "sys/net/netmap/netmap_vale.c:401-403",
    "sys/net/netmap/netmap_vale.c:595-600",
    "sys/net/netmap/netmap_vale.c:1448",
    "sys/net/netmap/netmap.c:1106-1133"
  ],
  "poc_changes": "finding authored this pass; harness written fresh (DF-3332 verbatim-KLD pattern). Two harness-side bugs fixed during iteration (own canary-scan u_int underflow; scratch kfree before walkers) - documented in build.log; verbatim function untouched.",
  "attempts": 6,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df3368 && make && make fixed   (KLD, -I/usr/src/sys, bsd.kmod.mk)",
  "run_cmd": "kldload ./df3368.ko; sysctl -n debug.df3368.mode=<0|1|2|3>; sysctl -n debug.df3368.trigger=1; kldunload df3368",
  "code_hash": "e1005dc8be42573af41988947b0292dadf95bfbcec82c51d05d0367cacfafed9",
  "notes": "netmap dead-code platform note applies (task_log 2026-09-11 01:03). Fixed variant validated A/B in-module; full-subsystem patched-kernel build impossible on this platform. Wild-write panic captured with harness v2 - the faulting instruction is the verbatim :1013 store.",
  "recommended_fix": "Cap fragment chains at NM_MULTISEG in nm_bdg_preflush (see fix.diff): treat slot as chain-terminating once frags == NM_MULTISEG.",
  "fix_status": "fixed",
  "fix_kernel_uname": "n/a (verbatim-function KLD A/B on stock kernel #0; netmap subsystem does not compile on this platform so a full patched-kernel build is impossible)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff caps fragment chains at NM_MULTISEG in nm_bdg_preflush. Validated A/B with the -DDD3368_FIXED variant of the same verbatim module: mode1 ft[0].ft_frags=64, walk terminates (4 steps); mode2/mode3 max index 1023 <= 1088, canary intact, flush invoked every batch - all three sinks (table overrun, past-object write, livelock) eliminated.",
  "fix_evidence": "run.log fixed-variant section (last 8 lines); fix.diff"
}