DF-0507
IPv6 port-selection hash XORs destination with itself: always zero, no load balancing
Summary
M_FEC_INET6 case(:1056-1057): port=(ip6_dst.s6_addr[15]^ip6_dst.s6_addr[15])&mask. Both operands are dst -> XOR always 0 -> all IPv6 flows pin to port 0. MAC and INET branches correctly use src^dst(:1046-1047,:1051-1052). Typo: should be ip6_src^ip6_dst. No security impact, disables IPv6 load balancing. Fix: ip6_src^ip6_dst.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0507 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | IPv6 port-selection hash XORs destination with itself: always zero, no load bala | 304 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netgraph7/ng_fec.c:1056: IPv6 port hash XORs dest with itself (always zero, no load balancing)
Verified recommended fix
Source-confirmed at sys/netgraph7/ng_fec.c:1056: IPv6 port hash XORs dest with itself (always zero, no load balancing)
Verdict
Source-confirmed at sys/netgraph7/ng_fec.c:1056: IPv6 port hash XORs dest with itself (always zero, no load balancing)
No comments yet.