⬢ DragonFlyBSD Kernel Audit
DF-3552 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-3552",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced live on the stock v1 netgraph stack: hooktest shows dlci5 -> EINVAL(22) and dlci55/dlci05 -> ENOBUFS(55) on a fresh sample node with all 16 channels free. Root causes in sys/netgraph/ng_sample.c: (1) the free-slot search loop (:221-227) has no break - it only ever continues, so chan always exits at XXX_NUM_DLCIS and every DLCI hook creation fails ENOBUFS; (2) cp = name + sizeof(NG_XXX_HOOK_DLCI_LEADIN) (:210) counts the NUL, skipping the first digit - single-digit names are impossible (dlci5 -> isdigit(\\0) -> EINVAL) and dlci55 parses as 5; (3) channel[chan].dlci is never assigned from the parsed value (:228-232), so duplicate-DLCI detection (:218-220) and the downstream demux search (:369-371) are dead even with (1)+(2) fixed; (4) xxxp->debughook is stored in newhook (:240) but never cleared in ng_xxx_disconnect (:460-466) - a latent stale pointer, never dereferenced in the file. Pure logic defects in demo/template code (module builds but does not ship; node creation root-gated) - no memory-safety impact.",
  "exploit_chain": "",
  "evidence": "run.log (hooktest dlci55 -> errno=55 twice; hooktest dlci5 -> errno=22), v1demo.c (hooktest mode; v1 generic cmds return newhooks errno synchronously from sendto(2)), fix.diff (four-part template repair, git-apply --check clean)",
  "kernel_refs": [
    "sys/netgraph/ng_sample.c:210",
    "sys/netgraph/ng_sample.c:218",
    "sys/netgraph/ng_sample.c:221",
    "sys/netgraph/ng_sample.c:228",
    "sys/netgraph/ng_sample.c:240",
    "sys/netgraph/ng_sample.c:460"
  ],
  "poc_changes": "Same v1demo.c driver as DF-3550 (hooktest mode); NGM_CONNECT initially waited for a response message, but v1 generic commands signal errors synchronously via sendto(2) and send no response - reworked to read the errno from sendto.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1800,
  "guest_dirty": 0,
  "build_cmd": "make -C /root/ngs1 KMOD=ng_sample; cc -O2 -Wall -o /root/v1demo /root/v1demo.c (same as DF-3550)",
  "run_cmd": "kldload ng_socket; kldload /root/ngs1/ng_sample.ko; /root/v1demo hooktest dlci55; /root/v1demo hooktest dlci5",
  "code_hash": "1517851c923420332e62c40c89ead87fbaeb6967e76d529de564364011b5e929",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Four-part fix in fix.diff (strlen instead of sizeof; break-on-free-slot; store channel[chan].dlci; clear debughook on disconnect); kernel rebuild validation skipped per contract for Info-severity template defects.",
  "fix_evidence": "fix.diff",
  "notes": "These defects make the templates DLCI feature entirely non-functional, which also explains why the DF-3550 reflection and the dead demux branch were never noticed in 25+ years.",
  "recommended_fix": "Apply fix.diff: fix the slot-search break, the sizeof/strlen off-by-one, the missing channel dlci assignment, and clear debughook on disconnect."
}