# DF-3494 — VERDICT

**reproduced / dos (kernel heap exhaustion) / certain** — two
error-path kernel heap leaks in the live v1 ng_parse, both of which the
ng7 copy of the same file already fixed upstream.

## What was reproduced (stock netgraph.ko, root)

* **(a) unterminated-quote token leak** — `NGM_ASCII2BINARY`
  `{name="` + 5000 'A's, 2000 iterations: `v_free_count` dropped
  **4239-9749 pages (16-38 MB)** across three runs (~2 tokenizations of
  the ~5 KB string leak per message: skip_value + field loop).
* **(b) string-unparse encode leak** — `NGM_BINARY2ASCII` whose inner
  message makes the ng_parse_ng_mesg_type "cmdstr" field land on
  attacker bytes with `strlen=19980` (see `dmesg.txt` instrumentation:
  `enc+` with no `enc-`): 1500 iterations consumed **117-118 MB
  (~78 KB/call = the ~80 KB ng_encode_string buffer)**. Sync error
  ERANGE is the leak-path signature.
* Controls: same-size sends to a nonexistent node (transport only) → no
  leak; `dlen=2000` unparse-success path → no leak. The leak is
  exclusively on the error paths, matching the code.

## Root causes (line-cited)

1. `ng_get_string_token` :1559 allocates cbuf, :1624 returns NULL on
   no-closing-quote without kfree → leak per failed tokenization.
2. `ng_string_unparse` :727 `NG_PARSE_APPEND("%s", s)` macro-returns
   ERANGE at :731 without freeing the ng_encode_string buffer `s`.
   (Plus the defense-in-depth member: `ng_unparse_composite`'s
   mid-loop appends :1274/:1278/:1285 return ERANGE leaking the 20 KB
   workBuf.)

ng7's copy of ng_parse.c contains the frees for both (kfree before
"no closing quote" return; ng_parse_append + kfree(s) on append error;
goto-fail for workBuf) — this finding is catching the live stack up to
the already-fixed ng7 code.

## Fix validation

`fix.diff` (v2) applied to the guest's /usr/src copy, netgraph.ko
rebuilt and reloaded: (a) **300 pages (~1 MB, noise)** and (b)
**41 pages (0 MB)** — both leaks eliminated; `vmstat -m` shows
M_NETGRAPH 0 in use. Baseline vs patched outputs in `run.3.log` vs
`fixrun.log`.

## Impact ceiling

Kernel heap exhaustion (system-wide memory starvation → allocation
failures/panic under pressure) by the netgraph-controlling user. The
ngc socket attach gate is `SYSCAP_RESTRICTEDROOT`
(ng_socket.c:172-173), i.e. real root — hence severity Low, filed for
upstream parity and defense-in-depth.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.