# DF-4432 — sln_rx() passes a NULL mbuf to ifp->if_input (kernel panic)

**File:** `sys/dev/netif/sln/if_sln.c`
**Class:** NULL-pointer dereference / local DoS (panic) — memcorrupt-adjacent
**Severity:** Medium — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

## Build

```
dfbsd-qemu/vm.sh run_root "sh /tmp/df4432/build.sh"
```
Builds `dfrnull.ko` as an in-tree module in the guest (`/usr/src/sys/modules/dfrnull`).

## Run

```
dfbsd-qemu/vm.sh run_root "/usr/src/sys/modules/dfrnull/run_root_step; kldload /usr/src/sys/modules/dfrnull/dfrnull.ko"
```
i.e. simply `kldload /usr/src/sys/modules/dfrnull/dfrnull.ko` as root on the guest.

## Expected

Immediate kernel panic on the serial console:

```
Fatal trap 12: page fault while in kernel mode
mp_lock=0x... cpuid=...; lapic.idx=...
fault virtual address   = 0x18     # offsetof(struct mbuf, m_len)
...
ether_input+0x.. at ...
```

The module replicates the exact statement of `sys/dev/netif/sln/if_sln.c:949`
(`ifp->if_input(ifp, m, NULL, -1);`) with the exact faulting argument
(`m == NULL`, the `m_devget()` failure value from `if_sln.c:915/928`).
The ancestor driver rl(4) guards this with `if (m == NULL) continue;`
(`if_rl.c:1095-1096`) before its own `ifp->if_input` at `if_rl.c:1099`;
the sln(4) port dropped that guard.

No SC92031 hardware is needed for this replica: the faulting statement is
reproduced verbatim. The in-driver trigger additionally requires cluster
exhaustion at RX-interrupt time (m_devget M_NOWAIT failure) plus traffic on
the sln interface — that half is code-certain by inspection, hardware-gated
on the QEMU guest (no Silan NIC present).