# DF-3562 — serpent_set_key() unsigned key-length wraparound (pass-2, batch anchor pack)

This pack is the evidence anchor for the **GLM-5.3 pass-2 audit of four
DragonFlyBSD kernel crypto files**:

| file | outcome |
|---|---|
| `sys/crypto/serpent/serpent.c` | **1 new finding (DF-3562)** + correctness verified |
| `sys/crypto/twofish/twofish.c` | clean (known DF-0965/2371/0966 stand; correctness verified) |
| `sys/crypto/rijndael/rijndael-api-fst.c` | clean pass 2 (known DF-0967/0968/0969/2369/2370 stand, two confirmed live; dead in-kernel code) |
| `sys/crypto/chachapoly.c` | clean pass 2 (known DF-0970/2363/2364/2365 stand; correctness verified incl. live wg(4) tunnel) |

## Build

On the DragonFly guest (sources at `/usr/src/sys`, SHA256-verified identical
to the audit tree — see `env.txt` era logs):

```sh
cd /tmp/DF-3562
./build.sh          # stages verbatim copies of the kernel sources; only
                    # kernel-only header includes are redirected to shims
                    # (recorded in verification/chachapoly/prep.sh)
./run.sh            # runs all four harnesses; exit 0 == all green
```

Prereqs: `cc` (guest base gcc 8.3), the pack directory.

## What each part proves

* `verification/serpent/serptest` — 4 Linux-mainline testmgr KATs + 169
  vectors from Botan's verified serpent corpus (128/192/256-bit keys,
  multi-block up to 1 KB) + 6000 random round-trips + 1000x iterated
  chains: **6349 checks, 0 fails**.
* `verification/serpent/serpoob` — the DF-3562 OOB demonstrations
  (3/3 fault on pristine code, 0/3 on fixed code):
  * Case A `key_len=-64`: `lk = (u_int32_t)((-64+31)/32) = 0xFFFFFFFF`
    → runaway `ctx->l_key[i]` fill loop (linear OOB write of key-buffer
    words, SIGSEGV at the first unmapped page).
  * Case B `key_len=-32`: `i = (u_int32_t)(-32/32) = 0xFFFFFFFF`
    → single wild access at `l_key[0xFFFFFFFF]` (+16 GiB, SIGBUS).
  * Case C `key_len=129`: `(129+31)/32 = 5` words read from a 17-byte
    key buffer → 3-byte OOB read (SIGSEGV on a guard page).
* `verification/twofish/twotest` — 6 published KATs (official
  ecb_ival-derived + LibTomCrypt) + 1000x iterated + 15000 random
  round-trips: **15018 checks, 0 fails**.
* `verification/rijndael-api/rijnapitest` — FIPS-197 ECB KATs,
  RFC 3602 CBC cases #1-#4, 192 pad round-trips, CFB1 single-block
  round-trip, and live confirmation records for the KNOWN pass-1
  findings DF-0968 (CBC numBlocks==0 writes a full block past the
  advertised 8-byte payload — canary clobbered) and DF-0969 (ECB
  padDecrypt rejects valid padLen==16 on 6/6 exact-multiple inputs):
  **208 checks, 0 fails** (known-bug confirmations counted separately).
* `verification/chachapoly/cptest` — RFC 8439 §2.8.2 AEAD (ct+tag
  byte-exact), RFC 8439 A.5 decrypt+re-encrypt, draft-irtf-cfrg-xchacha
  A.1 both directions, tamper rejection (ct/tag/aad), 264 boundary
  round-trips (0..4096 B × ad lengths × chacha/xchacha × separate and
  in-place), and the mbuf API through bounds-aborting DFly-faithful
  mbuf shims (9 lengths × 6 fragmentation patterns byte-matched against
  the contiguous result, corruption → EBADMSG): **22 checks, 0 fails**.
* `wg_e2e.log` — live kernel end-to-end: two wg(4) peers over loopback
  UDP (kldload if_wg), 200/200 + 20/20 (1300 B) pings, 0% loss — the
  real in-kernel chacha20poly1305 mbuf/handshake paths.

## Fix validation (DF-3562)

`fix.diff` adds the missing lower-bound / byte-multiple check to
`serpent_set_key()`.  `fix_build.log` / `fix_run.log` show it applied to
a verbatim `/usr/src` copy of the file, rebuilt, and re-run:
baseline 3/3 faults → patched 0/3 faults, KAT corpus still 6349/0.
A full kernel rebuild was not performed for this fix: the changed line
is unreachable from any in-tree caller (cryptoapi.c serpent_cbc_setkey /
serpent_xts_setkey validate 128/192/256 (and 256/512 halved) bits before
calling — see VERDICT.md), so no kernel code path can observe a behavior
difference; the harness rebuild exercises the identical function source.

## Files

```
build.sh run.sh                  exact build/run entry points
serpoob.c                        DF-3562 OOB demonstration
fix.diff                         the fix (git-apply-able vs sys/)
build.log run.log env.txt        full untrimmed guest logs
fix_build.log fix_run.log        fix-validation logs
wg_e2e.log                       live wg(4) end-to-end
verification/serpent/            serptest.c serpoob (built) kats_serpent.txt
verification/twofish/twotest.c
verification/rijndael-api/rijnapitest.c
verification/chachapoly/         cptest.c shim_systm.h shim_mbuf.h prep.sh
```