Receive-path filter dereferences mbuf data without m_pullup: OOB read within mbuf cluster on short first mbuf
Summary
ng_btsocket_hci_raw_data_input(:474-545): passes mbuf to filter(:511) without m_pullup. Filter derefs *mtod 1 byte + opcode bytes 1-2 + event byte 1 = up to 3 contiguous bytes with only m_len guaranteed. Comment "XXX do we have to call m_pullup here?"(:506-509). Send path(:1638-1643) correctly pullups sizeof(cmd_pkt). Compromised controller or netgraph injection with short first mbuf -> OOB read within cluster.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0437 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source verification verdict | 732 B | ↓ raw |
| fix.diff | suggested-fix | fix for oob-read bug | 460 B | view raw |
DF-0437 - Verification Verdict
Verdict: REPRODUCED (source-only confirmation)
Bug class: oob-read
Impact: none
Source file: sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c
Mechanism
CONFIRMED: Passes mbuf to filter without m_pullup. Filter derefs up to 3 contiguous bytes with only m_len guaranteed. Fix: add m_pullup.
Fix
See fix.diff for the git-apply-able patch.
Build validation
Combined kernel build with all 70 Low-severity fixes: rc=0, -Werror.
All fixes compile cleanly in X86_64_GENERIC kernel configuration.
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix verification
fixedVALIDATED: fix.diff compiles cleanly in combined kernel build (rc=0, -Werror). Source trace confirms bug at sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:511.
Combined build: 70 fix.diffs applied to /usr/src, nativekernel KERNCONF=X86_64_GENERIC rc=0 -Werror. All fixes compile.
Confirmed kernel references
- s
- y
- s
- /
- n
- e
- t
- g
- r
- a
- p
- h
- 7
- /
- b
- l
- u
- e
- t
- o
- o
- t
- h
- /
- s
- o
- c
- k
- e
- t
- /
- n
- g
- _
- b
- t
- s
- o
- c
- k
- e
- t
- _
- h
- c
- i
- _
- r
- a
- w
- .
- c
- :
- 5
- 1
- 1
Detail
Exploit chain
none (non-corruption Low severity finding; source-only confirmation)
Evidence (decisive lines)
Source-traced at sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:511. Combined kernel build with all 70 fixes: rc=0, -Werror.
PoC changes
Created fix.diff for DF-0437. No PoC binary (source-only verification).
Verified recommended fix
Add m_pullup before filter call. Matches finding proposal.
Verdict
CONFIRMED source-only: filter derefs mbuf without m_pullup. OOB if m_len < 3.
No comments yet.