{
  "finding_id": "DF-3444",
  "title": "bpf_filter() executes unvalidated BPF programs via ipfw3_layer4 check_bpf: arbitrary-offset kernel stack read/write, RIP control",
  "verdict": "reproduced",
  "impact": "panic",
  "impact_detail": "kernel memory corruption: controlled u32 write at mem+4k for any u32 k (demonstrated +512MB and saved-RIP k=26/27 -> full RIP control 0x414142424343); unvalidated programs also need not terminate (OOB instruction walk)",
  "reproduce": {
    "build": "cc -O -o poc3444 poc.c",
    "run": "sysctl net.filters_default_to_accept=1; kldload ipfw3; kldload ipfw3_basic; kldload ipfw3_layer4; ./poc3444 empty | store 0xcafebabe 0x08000000 | riptake",
    "expected": "unpatched #0: deterministic panic (signatures in panic.txt); patched #1 (fix.diff): all modes survive, networking healthy"
  },
  "kernel_refs": [
    "sys/net/bpf_filter.c:365", "sys/net/bpf_filter.c:366", "sys/net/bpf_filter.c:370",
    "sys/net/bpf_filter.c:374", "sys/net/bpf_filter.c:378", "sys/net/bpf_filter.c:498",
    "sys/net/ipfw3_layer4/ip_fw3_layer4.c:201",
    "sys/net/ipfw3/ip_fw3.c:655", "sys/net/ipfw3/ip_fw3.c:951", "sys/net/ipfw3/ip_fw3.c:506",
    "sys/net/bpf.c:1076", "sys/netgraph/bpf/ng_bpf.c:481",
    "sys/netinet/raw_ip.c:473"
  ],
  "artifacts": ["poc.c", "build.sh", "run.sh", "build.log", "run.log", "fix_run.log", "panic.txt", "fix.diff", "fix_build.log", "env.txt", "VERDICT.md", "manifest.json", "verdict.json"]
}