⬢ DragonFlyBSD Kernel Audit
DF-3461 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-3461",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info hardening: the in6_cksum() sanity check at sys/netinet6/in6_cksum.c:116 computes off+len in unsigned 32-bit; a wrapping pair bypasses the intended panic and the mbuf walk then ends with m==NULL so lines 157-158 dereference the NULL mbuf (uncontrolled low-page fault instead of the diagnostic panic). Pass-2 caller matrix proves no in-tree caller can supply wrapping off/len (ip6_input.c:628-638 clamps pkthdr.len to 40+ip6_plen; icmp6/udp6/tcp6/raw_ip6 all derive off/len from the clamped chain and pull up L4 headers first), so this is unreachable defense-in-depth. The userland arithmetic mirror (wrap_demo.c, run.log) demonstrates the bypass + NULL-walk exactly; no kernel PoC run for an Info finding. Overflow-safe re-statement of the invariant authored as fix.diff (applies cleanly, not built).",
  "exploit_chain": "",
  "evidence": "run.log (guest-built mirror: sanity check BYPASSED, after walk: m=0x0); VERDICT.md caller-matrix table; fix.diff",
  "kernel_refs": [
    "sys/netinet6/in6_cksum.c:116",
    "sys/netinet6/in6_cksum.c:150-158",
    "sys/netinet6/in6_cksum.c:285-286",
    "sys/netinet6/ip6_input.c:628-638"
  ],
  "poc_changes": "n/a \u2014 finding authored in this run; mirror written fresh",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o wrap_demo wrap_demo.c (guest)",
  "run_cmd": "./wrap_demo (guest /tmp)",
  "code_hash": "28a6b5806bd29f3b0b51cdbcda7ff075557cc04cfcdc1265a4843877c6dee29c",
  "notes": "Phase V skipped per policy for Info hardening findings (no Critical/High, no memcorrupt/privesc bucket). Guest used only for the arithmetic mirror build (cc 8.0.1-dragonfly [clang 8.3]); no kernel state touched, guest left clean.",
  "recommended_fix": "Replace `m->m_pkthdr.len < off + len` at in6_cksum.c:116 with the overflow-safe `len > (u_int32_t)m->m_pkthdr.len || off > (u_int32_t)m->m_pkthdr.len - len` (see fix.diff)",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info/unreachable finding: single-fix kernel rebuild not applicable; fix.diff authored and patch-verified only (patch --dry-run OK)",
  "fix_evidence": "fix.diff (git-apply-able unified diff against sys/netinet6/in6_cksum.c)"
}