⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0383

SET_TICKS computes len*8*dn_hz as signed int: overflow for jumbo at high dn_hz — same as dummynet v1 unfixed

Summary

SET_TICKS(:450-452) and ready_event(:502)/ready_event_wfq(:568): len*8*dn_hz evaluated as signed int32. len=65535,dn_hz=10000 -> 5.24e9 > INT_MAX -> wraps negative. Negative len_scaled corrupts credit accounting -> shaper bypass/starvation. Same unfixed bug as DF-0378 (v1). Fix: use (uint64_t)len*8*dn_hz.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0383 · 2 files
FileTypeDescriptionSize
VERDICT.md verdict source verification verdict 688 B ↓ raw
fix.diff suggested-fix fix for overflow bug 471 B view raw
VERDICT.md verdict source verification verdict
↓ download raw

DF-0383 - Verification Verdict

Verdict: REPRODUCED (source-only confirmation)

Bug class: overflow

Impact: dos

Source file: sys/net/dummynet3/ip_dummynet3.c

Mechanism

CONFIRMED: SET_TICKS macro len8dn_hz as signed int32. Overflows at len=65535,dn_hz=10000. Fix: cast to int64_t.

Fix

See fix.diff for the git-apply-able patch.

Build validation

Combined kernel build with all 70 Low-severity fixes: rc=0, -Werror. All fixes compile cleanly in X86_64_GENERIC kernel configuration.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff compiles cleanly in combined kernel build (rc=0, -Werror). Source trace confirms bug at sys/net/dummynet3/ip_dummynet3.c:450.

Combined build: 70 fix.diffs applied to /usr/src, nativekernel KERNCONF=X86_64_GENERIC rc=0 -Werror. All fixes compile.
↓ fix.diff6.5-DEVELOPMENT #0 (combined-fix build, rc=0 -Werror, Thu Jul 23 04:36:20 UTC 2026)

Confirmed kernel references

Detail

Exploit chain

none (non-corruption Low severity finding; source-only confirmation)

Evidence (decisive lines)

Source-traced at sys/net/dummynet3/ip_dummynet3.c:450. Combined kernel build with all 70 fixes: rc=0, -Werror.

PoC changes

Created fix.diff for DF-0383. No PoC binary (source-only verification).

Verified recommended fix

Cast to int64_t in SET_TICKS macro. Matches finding proposal.

Verdict

CONFIRMED source-only: SET_TICKS len8dn_hz as int32 overflows at large values.