DF-0406 — in_delayed_cksum unchecked m_pullup return

Bug (certain by inspection)

sys/netinet/ip_output.c:940-951:

if (offset + sizeof(u_short) > m->m_len) {
    kprintf("delayed m_pullup, m->len: %d  off: %d  p: %d\n", ...);
    /*
     * XXX
     * this shouldn't happen, but if it does, the
     * correct behavior may be to insert the checksum
     * in the existing chain instead of rearranging it.
     */
    m = m_pullup(m, offset + sizeof(u_short));   /* <-- return NOT checked */
}
*(u_short *)(m->m_data + offset) = csum;         /* <-- NULL deref if m_pullup fails */

The comment "this shouldn't happen but if it does" acknowledges the possibility without actually handling the failure. If m_pullup returns NULL (memory pressure), the assignment writes to address 0 + offset → panic.

Trigger requirements

1. The egress interface must NOT advertise CSUM_DELAY_DATA in if_hwassist (otherwise ip_output:641 skips in_delayed_cksum). vtnet0 and lo0 both advertise TX csum offload by default, so on the default guest ifconfig vtnet0 -txcsum -rxcsum is required to make in_delayed_cksum actually run on TX.
2. The checksum field must straddle an mbuf boundary (offset + sizeof(u_short) > m->m_len). Normal UDP/TX packs the whole packet into a single mbuf cluster, so m->m_len equals the full packet length and the straddle if is never entered. The straddle needs a multi-mbuf chain whose first mbuf ends near offset (typically 26 for UDP, 36 for TCP, more with IP options) — an unusual layout.
3. m_pullup must return NULL — i.e., memory pressure.

Build / Run

cc -O2 -Wall -o df_0406_cksum df_0406_cksum.c
cc -O2 -Wall -o df_0406_sf   df_0406_sf.c

Setup (as root): ifconfig vtnet0 -txcsum -rxcsum Run (as any user): ./df_0406_cksum 10.0.2.2 9 and ./df_0406_sf 10.0.2.2 9

Expected

• BUG (live, requires straddle + memory pressure): kernel panic Fatal trap 12: page fault while in kernel mode at the assignment in in_delayed_cksum.
• LIVE (this guest): in_delayed_cksum is called for every TX packet but the straddle if is never entered (single-mbuf TX). No delayed m_pullup kprintf, no panic. Code-certain; non-deterministic live trigger.
• FIX: drop the packet on m_pullup failure instead of dereferencing NULL.

Reality

Code-certain CWE-690 / CWE-476. The path runs on every TX when HW csum is disabled, but the straddle condition requires unusual mbuf-chain layout and the NULL-deref additionally requires memory pressure. Non-deterministic on this guest; the fix is trivially correct.