⬢ DragonFlyBSD Kernel Audit
DF-3379 / run.log
← back to finding ↓ download raw
DF-3379 — decisive behavioral + static run (kernel #1, patched, INVARIANTS; engine deadness
is independent of the DF-3380 fix)

$ ./trigger_df3379
[*] SIOCSETPFSYNC(syncdev=lo0, syncpeer=10.0.2.2, maxupd=128)
[+] pfsync0 configured; a live engine would now sync every pf state to 10.0.2.2
[+] SIOCGETPFSYNC: syncdev=lo0 maxupd=128          <-- config confirmed by kernel
pf enabled

===STATES===                                       <-- state table live and flowing
all icmp 10.0.2.15:28675 -> 10.0.2.2:28675       0:0
all tcp 10.0.2.15:22 -> 10.0.2.2:36174       ESTABLISHED:ESTABLISHED

===VTNET240===                                     <-- physical NIC toward the unicast peer
listening on vtnet0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
0 packets captured
6 packets received by filter
0 packets dropped by kernel

===LO240===                                        <-- syncdev interface
listening on lo0, link-type NULL (BSD loopback), snapshot length 262144 bytes
0 packets captured
0 packets received by filter
0 packets dropped by kernel

===PING===
3 packets transmitted, 3 packets received, 0.0% packet loss

===STATIC_PFSYNCIF===                              <-- the only assignment in the tree is NULL
90:struct pfsync_softc	*pfsyncif = NULL;
466:	struct pfsync_softc *sc = pfsyncif;
1278:	struct pfsync_softc *sc = pfsyncif;
1445:	struct pfsync_softc *sc = pfsyncif;
1488:	struct pfsync_softc *sc = pfsyncif;

===STATIC_NPFSYNC===                               <-- RX dispatch never compiled
281:#ifdef NPFSYNC
296:#endif	/* NPFSYNC */
ls: /usr/src/sys/config/use_pfsync.h: No such file or directory

===ENV===
DragonFly dfbsd 6.5-DEVELOPMENT #1: Fri Sep 11 21:24:50 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

Interpretation: with syncdev=lo0 AND unicast peer 10.0.2.2 configured, pfsync_pack_state()'s
"nobody listening" early-out (if_pfsync.c:1294-1303) cannot apply (it requires
sc_sync_peer == INADDR_PFSYNC_GROUP); a functional pfsync would serialize each INS/UPD
(pfsync_insert_state/pfsync_update_state hooks in pf) and transmit to 10.0.2.2 within the
1-second sc_tmo tick. Observed: zero proto-240 packets anywhere, while states were created
and updated. Combined with the static proof (pfsyncif never assigned), the sync engine is
dead on this tree.

Earlier corroborating run on the stock kernel (boot #0, 21:09 UTC): same setup minus the
explicit unicast peer (peer keyword unsupported by DF ifconfig -> stayed default group);
tcpdump -i vtnet0 proto 240 also captured 0 packets over a window with 2 TCP + 3 ICMP
states (run captured live during audit; pcap header-only, 24 bytes).