{
 "finding_id": "DF-3392",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "REPRODUCED on stock INVARIANTS guest: after root loads the shipped ip6fw.ko (the only way to use DFs IPv6 firewall; option absent from X86_64_GENERIC so ip6_fw_ctl_ptr==NULL by default - verified dead path), uid 65534 on a plain socket(AF_INET6, SOCK_DGRAM) adds/deletes/flushes ip6fw rules via setsockopt(IPPROTO_IPV6, IPV6_FW_*) with no privilege check anywhere on the path (ip6_ctloutput computes privileged but the IPV6_FW cases never consult it; ip6_fw_ctls only gate is securelevel>2, and securelevel is -1 by default). Policy bypass proven behaviorally: default deny ipv6 from any to any blocks ping6 ::1; nobodys IPV6_FW_ADD of allow from any to any (#1) restores it (ip6fw show confirms the nobody-installed rule live in the kernel chain); nobodys DEL/FLUSH re-breaks/re-wipes the policy at will. Contrast the v4 ipfw path which requires a raw IP socket gated by SYSCAP_NONET_RAW. Impact is firewall policy bypass/manipulation + IPv6 DoS by unprivileged local users once ip6fw is enabled - NOT memory corruption and not uid=0. Fix (priv gate mirroring the files own if (!privileged) return EPERM pattern) validated by full in-guest kernel rebuild: patched kernel returns EPERM to uid 65534 for ADD/DEL/FLUSH/ZERO/GET while root operation is unchanged.",
 "exploit_chain": "1) any local user: socket(AF_INET6, SOCK_DGRAM, 0) [in6_proto.c:142 -> ip6_ctloutput_dispatch]; 2) setsockopt(IPPROTO_IPV6, IPV6_FW_ADD, rule, 200) [ip6_output.c:1534, no priv gate] -> ip6_fw_ctl [ip6_fw.c:1119 securelevel-only gate] -> add_entry6 installs the rule; 3) 00001 allow ipv6 from any to any shadows the admins 65535 deny -> all IPv6 filtering bypassed; alternatively FLUSH/DEL/DENY rules -> unpriv IPv6 blackout.",
 "evidence": [
  "run.log: IPV6_FW_ADD: ACCEPT-any rule #1 added, uid=65534, ret=0 + ping6 ::1 toggling 100% loss -> 0% loss -> 100% loss with nobodys add/del",
  "run.2.log: /sbin/ip6fw show listing 00001 allow ipv6 from any to any immediately after nobodys ADD (authoritative kernel-chain proof)",
  "fix.log: patched kernel #1 - nobody: Operation not permitted on ADD/FLUSH/ZERO/DEL; root: IPV6_FW_ADD ... uid=0, ret=0 + ip6fw show works",
  "probe.c output (fix.log tail): nobody GET with valsize<=SOMAXOPT_SIZE -> EPERM (gate); the earlier GET EINVAL was sys_getsockopts non-root valszmax cap (uipc_syscalls.c:1323-1330), not the protocol layer"
 ],
 "kernel_refs": [
  "sys/netinet6/in6_proto.c:142",
  "sys/netinet6/ip6_output.c:1156",
  "sys/netinet6/ip6_output.c:1534",
  "sys/netinet6/ip6_output.c:1760",
  "sys/net/ip6fw/ip6_fw.c:1119",
  "sys/netinet/raw_ip.c:473",
  "sys/net/ipfw/ip_fw2_glue.c:65",
  "sys/kern/uipc_syscalls.c:1323"
 ],
 "poc_changes": "seed had no runnable source; wrote ip6fw_ctl.c from struct ip6_fw in sys/net/ip6fw/ip6_fw.h. Fixed: added <sys/queue.h> (LIST_ENTRY in header), moved binary to /tmp for nobody (mode 700 /root), DF ping6 has no -W flag, GET buffer must be <= SOMAXOPT_SIZE for non-root or sys_getsockopt returns EINVAL before the protocol layer (102400-byte buffer gave a misleading EINVAL; 200 bytes shows the true EPERM on patched / would reach ip6_fw_ctl on stock).",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 3410,
 "guest_dirty": 0,
 "build_cmd": "cc -O -o /root/ip6fw_ctl -I./ ip6fw_ctl.c",
 "run_cmd": "kldload ip6fw.ko; su -m nobody -c /tmp/ip6fw_ctl add; /sbin/ip6fw show; ping6 -c 1 ::1",
 "code_hash": "be79f3a2bfebe6056e631ed183e07a08fd9a7d68467830d159d7cd5803ea4a58",
 "notes": "Platform fact established (DF-3307 style): ip6fw dead on default config (no option IPV6FIREWALL in sys/config/X86_64_GENERIC, ip6_fw_ctl_ptr NULL, net.inet6.ip6.fw.enable absent) BUT ip6fw.ko is shipped in /boot/kernel and /sbin/ip6fw userland exists, so the surface activates on the standard kldload ip6fw admin opt-in. IPV6_FW_GET via sockopt also has a pre-existing multi-mbuf plumbing quirk (sopt_from_mbuf on a chain); the privilege fix gates it regardless. securelevel is -1 by default, so the securelevel>2 gate never applies.",
 "recommended_fix": "Add if (!privileged) return (EPERM); to the IPV6_FW_{ADD,DEL,FLUSH,ZERO} and IPV6_FW_GET cases of ip6_ctloutput() (the variable is already computed at ip6_output.c:1156 and used by five other option cases), matching the raw-socket privilege boundary the v4 ipfw path gets via SYSCAP_NONET_RAW.",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Sat Sep 12 02:34:55 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff applied to in-guest /usr/src, full nativekernel rebuild, reboot into #1: nobody now receives EPERM for IPV6_FW_ADD/DEL/FLUSH/ZERO/GET (fix.log + probe output); root management (ADD/DEL, ip6fw show, GET) unchanged; default-deny enforcement and module load/unload unchanged. Baseline (stock #0) reproduced the bypass as uid 65534.",
 "fix_evidence": "findings/poc/DF-3392/fix.log; findings/poc/DF-3392/fix.diff; kbuild.log KERNEL_DONE marker; uname #1"
}