DF-0416
TCP_MAXSEG minmss floor can raise t_maxseg above current negotiated value on small-MTU paths
Summary
tcp_ctloutput TCP_MAXSEG(:1613-1619): guard optval<=t_maxseg intends only decrease. But minmss floor: if(optval+40<tcp_minmss) optval=tcp_minmss-40 can RAISE optval above t_maxseg when t_maxseg<176 (constrained PMTU). User requests 50, guard passes (50<=100), minmss bumps to 176 > 100 -> MSS raised beyond path MTU. Logic inconsistency violates "only reduce MSS" contract. No memory safety.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0416 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 390 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netinet/tcp_usrreq.c:1613: TCP_MAXSEG minmss floor can raise t_maxseg above negotiated value
Verified recommended fix
Source-confirmed at sys/netinet/tcp_usrreq.c:1613: TCP_MAXSEG minmss floor can raise t_maxseg above negotiated value
Verdict
Source-confirmed at sys/netinet/tcp_usrreq.c:1613: TCP_MAXSEG minmss floor can raise t_maxseg above negotiated value
No comments yet.