# DF-3439 — VERDICT

**Status: reproduced** (kernel use-after-free: deny-all blackhole + deterministic
panic). **Fix validated** on a rebuilt kernel (single-hunk fix, bad behavior gone).

## The bug

`check_skipto()` (sys/net/ipfw3_basic/ip_fw3_basic.c:175-185) jumps through a
**cached** rule pointer:

```c
if ((*f)->next_rule == NULL)
        lookup_next_rule(*f);          /* caches me->next_rule = target */
*f = (*f)->next_rule;                  /* jump */
*cmd_ctl = IP_FW_CTL_AGAIN;            /* re-enter the walk at the target */
```

`lookup_next_rule()` (ip_fw3_basic.c:104-124, twin at ip_fw3.c:288-307) scans
`me->next` for the first rule with `rulenum >= cmd->arg1` and stores the pointer
in `me->next_rule`. The cache is **never invalidated**: `ip_fw3_delete_rule()`
(sys/net/ipfw3/ip_fw3.c:757-768) unlinks and `kfree()`s a rule — its own comment
says *"The caller is in charge of clearing rule pointers to avoid dangling
pointers"* — but no caller (`delete_rule_dispatch` ip_fw3.c:824-841,
`ip_fw3_ctl_delete_rule` ip_fw3.c:844-863) walks the chain to clear `next_rule`
caches. (`flush_rule_dispatch` ip_fw3.c:771-791 frees *all* rules, so caches die
with their owners — only single-rule deletion leaves dangling caches.)

Next packet through the skipto rule: `*f = <freed chunk>` → `goto again` →
`ctx->sets & (1 << f->set)`, `f->cmd_len`, `f->cmd` are read from freed memory
and `filter_funcs[cmd->module][cmd->opcode](...)` (ip_fw3.c:506) dispatches
through module/opcode bytes of freed (reusable, groomable) heap — the
DF-0473 unvalidated-dispatch family reached from a dangling rule pointer. On a
terminal action, `f->pcnt++ / f->bcnt +=` (ip_fw3.c:575-577) **writes** into the
freed chunk.

## Reproduction (root; firewall rule churn is a normal root-daemon activity;
## the trigger packet side needs no privilege)

Setup per run: `sysctl net.filters_default_to_accept=1` **before** module load
(so the default rule is ACCEPT and ssh survives), `kldload ipfw3 ipfw3_basic`,
then via `ipfw3x` (raw `setsockopt(IPPROTO_IP, IP_FW_X)` client, included):

1. `add 200 protodeny 1` — rule "proto 1 -> deny icmp" (4 words)
2. `add 100 skipto 200` — action rule whose first packet caches
   `rule100->next_rule = &rule200` (verified live via `krules`, a libkvm
   `/dev/kmem` walker: `num=100 ... next_rule=0x...4f1837a0` ==
   `num=200` rule address)
3. `ping -c4 127.0.0.1` → 100% loss (skipto → live rule 200 → deny), no panic
4. `del 200` → rule 200 freed on every CPU; rule 100's cache dangles

Observed on the stock INVARIANTS kernel (#0):

* **Behavioral UAF**: ICMP stays 100%-denied (`sendto: Permission denied`)
  after the only deny rule was deleted from a default-ACCEPT chain; the freed
  chunk is still executed through the stale cache. Once ordinary kernel
  activity reuses the chunk, every packet through the cache hits garbage and
  the console floods `+++ ipfw: ouch!, skip past end of rules, denying packet`
  (ip_fw3.c:570) — a total traffic blackhole that killed ssh
  (blackhole_console.txt).
* **Deterministic panic**: with `sysctl debug.use_weird_array=1` (freed-chunk
  poison 0xdeadc0de, kern_slaballoc.c:1560-1571) before the delete, the first
  packet after the delete dies with

  ```
  Fatal trap 9: general protection fault while in kernel mode
  instruction pointer = 0x8:0xffffffff826001a4
  Stopped at ip_fw3_chk+0x1a4: ret
  ```

  (panic.txt): the walk dispatched through poisoned module/opcode bytes
  (`filter_funcs[0xad][0xc0de]`-style OOB function-pointer read, indirect
  call to garbage, frame smashed, GPF at the `ret`).

## Primitive characterization

* read: `f->set`, `f->cmd_len`, `f->cmd[i]` from the freed M_IPFW3 chunk
* call: `filter_funcs[module][opcode]` with both indices from freed bytes —
  the chunk is refillable by a new rule (rule bodies are attacker-supplied
  instruction words), i.e. a controlled-content indirect-call setup for
  whoever can both delete the target and allocate a same-zone replacement
  (root on the box; the packet trigger itself is unprivileged)
* write: `f->pcnt++`, `f->bcnt += ip_len` into the freed chunk on terminal
  actions (memory corruption of a foreign allocation once reused)

Escalation ceiling: setup requires firewall-admin privilege (root), so this is
not an unpriv→root chain on its own; severity is from memory corruption +
packet-path availability impact (deny-all blackhole) reachable through routine
firewall rule churn.

## Fix validation

`fix.diff` (authored after verification; generated with `diff -u`, applies with
`patch -p1`): in `delete_rule_dispatch()`, before freeing, walk the per-CPU
chain and NULL every `->next_rule` that targets the deleted rule — the same
strategy FreeBSD's ipfw uses (flush_rule_pointers).

* `vm.sh reset with-src`; apply in guest `/usr/src`; `make -j6 nativekernel`
  (+install) → kernel #1; identical PoC phases:
  - pre-delete identical (deny works, cache populated: `next_rule == &rule200`)
  - after `del 200`: dump shows `rule100.next_rule = 0x0` (cleared; a CPU that
    already saw traffic re-cached onto the **live** default rule)
  - `ping` after delete: **0% loss** (fresh lookup → default accept)
  - no ouch flood, no panic, guest up.
* fix_status: **fixed** (baseline reproduced on #0, patched #1 clean).

## Files

- `ipfw3x.c` — IP_FW_X rule client (add protodeny/skipto/allow, del, flush, show)
- `krules.c` — libkvm walker dumping per-CPU `fw3_ctx->rules` incl. `next_rule`
- `kfdump.c` — libkvm dump of `filter_funcs[0][*]` (registration sanity)
- `run.sh` — phase-split reproduction script
- `run.log`, `panic.txt`, `blackhole_console.txt` — captured evidence
- `fix.diff` — the validated one-hunk fix

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.