DragonFlyBSD Kernel Audit
← dashboard
DF-0283

Unconditional kernel panic if mbuf chain ends with zero-length mbuf

Summary

receive_frame(:1956-1960) for(m=m0;m->m_next;m=m->m_next); if(m->m_len<=0) panic(). XXX comment: lets hope it never happens. Hard panic on malformed input instead of graceful drop. Reachability depends on L2CAP delivering trailing empty mbuf.