DF-0382 — config_red divide-by-zero panic

Bug

sys/net/dummynet3/ip_dummynet3.c:1351 and :1354:

x->c_1 = ioc_fs->max_p / (ioc_fs->max_th - ioc_fs->min_th);   /* div0 if max_th==min_th */
...
if (x->flags_fs & DN_IS_GENTLE_RED) {
    x->c_3 = (SCALE(1) - ioc_fs->max_p) / ioc_fs->max_th;      /* div0 if max_th==0 */

set_fs_parms (:1452) calls config_red and ignores its return ("XXX should check errors"), so neither denominator is validated before the divides.

Reach

setsockopt(s, IPPROTO_IP, IP_DUMMYNET_CONFIGURE /*60*/, &ioc_pipe, sizeof ioc_pipe) on a raw IP socket (socket(AF_INET, SOCK_RAW, IPPROTO_RAW)). Handled by rip_ctloutput → ip_dn_sockopt → config_pipe → set_fs_parms → config_red. The raw IP socket requires SYSCAP_NONET_RAW (sys/netinet/raw_ip.c:rip_attach), i.e. root or jail-root (the finding's stated threat: jail-root can panic the host kernel).

Build

cc -O2 -o df_0382_div0 df_0382_div0.c

Run (as root — needs raw socket capability)

./df_0382_div0            # default: max_th==min_th path (line 1351)
./df_0382_div0 gentle     # GENTLE_RED path, max_th==0 (line 1354)

Expected (bug present)

Kernel divide-by-zero panic — pid 0 (setsockopt) trap 9: divide error. Guest dies, ssh drops, dfbsd-qemu/boot.log shows the panic.

Preconditions

• kldload dummynet3 (or build-time). On this guest the module is not auto-loaded; ip_dn_sockopt returns ENOENT/ENOEXEC until it is loaded, so the trigger script loads it as root before issuing the option.
• Root-equivalent credential (raw socket capability).