{
  "finding_id": "DF-3369",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "bdg_netmap_rxsync (netmap_vale.c:1485-1535, nm_rxsync of every VALE port) validates the user-writable ring->reserved only via resvd + ring->avail >= lim + 1 (:1503), which wraps uint32: reserved=0xFFFFFFFF + avail=1 -> sum 0, check false; k = cur + lim + 1 - resvd = cur+1025 (mod 2^32) escapes [0..lim] and the release loop for (n=0; j!=k; n++) ... j=nm_next(j,lim) (:1515) can never terminate. Proven in-kernel with the verbatim function in a KLD on the stock kernel: module reports the check defeated (0x00000000 >= 1024 ? FALSE (wrap defeats check)), k=1030 OUTSIDE [0..1023], 1,000,000 iterations without termination; on the real subsystem the loop spins forever holding kring->q_lock LK_EXCLUSIVE with no bail-out - unkillable NIOCRXSYNC, permanently locked ring (local DoS). Fixed variant (reject resvd >= lim+1) terminates in 5 iterations on the same input.",
  "exploit_chain": "open /dev/netmap -> NIOCREGIF vale port -> mmap ring -> write ring->cur=5, ring->reserved=0xFFFFFFFF, ring->avail=1 -> ioctl(NIOCRXSYNC) -> bdg_netmap_rxsync spins forever under q_lock. Impact ceiling DoS (loop body only clears NS_BUF_CHANGED in shared memory; no corruption primitive).",
  "evidence": "run.log: check (resvd+avail >= lim+1): 0x00000000 >= 1024 ? FALSE (wrap defeats check); RESULT NON-TERMINATING: 1000000 iterations without j reaching k (k = 1030 is OUTSIDE [0..1023]); control terminates (1 iter); fixed: [D] XXX invalid reserve/avail 4294967295 1 then terminated after 5 iterations.",
  "kernel_refs": [
    "sys/net/netmap/netmap_vale.c:1485-1493",
    "sys/net/netmap/netmap_vale.c:1502-1508",
    "sys/net/netmap/netmap_vale.c:1510-1528",
    "sys/net/netmap/netmap_vale.c:1551",
    "sys/net/netmap/netmap_vale.c:914-918"
  ],
  "poc_changes": "finding authored this pass; fresh verbatim-KLD harness. Marked bail-out counter is the only addition to the loop.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cd /root/df3369 && make && make fixed",
  "run_cmd": "kldload ./df3369.ko; sysctl -n debug.df3369.mode=1; sysctl -n debug.df3369.trigger=1; kldunload df3369",
  "code_hash": "f6cc7310d860640cd21cc35aa19306fc4a858c153b5a18ea5087d7e3b05b63f7",
  "notes": "Sibling of DF-3332 (netmap.c grab_packets, same unvalidated ring->reserved class, different function/file/sink). netmap dead-code platform note applies; verbatim-KLD is the established verification path.",
  "recommended_fix": "Reject resvd >= ring size as well (see fix.diff): if (resvd >= lim + 1 || resvd + ring->avail >= lim + 1).",
  "fix_status": "fixed",
  "fix_kernel_uname": "n/a (verbatim-function KLD A/B on stock kernel #0; netmap subsystem does not compile on this platform)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds resvd >= lim + 1 || to the sanity check. Validated A/B with the -DDD3369_FIXED variant: the 0xFFFFFFFF reserve is now rejected (XXX invalid reserve/avail 4294967295 1), k stays in range, loop terminates in 5 iterations on the same input.",
  "fix_evidence": "run.log fixed-variant section; fix.diff"
}