DF-0518 — ICMP error generation (icmp_error) not rate-limited

Verdict: REPRODUCED (DoS / reflection-amplification hardening gap)

The bug is real and demonstrable from an unprivileged local user (and therefore trivially from any remote spoofed attacker, per the finding's threat model). badport_bandlim() / icmplim rate-limiting is applied at ICMP_ECHO (ip_icmp.c:787) and ICMP_TSTAMP (ip_icmp.c:807) replies and at the UDP-no-listener caller (udp_usrreq.c:609), but not inside icmp_error() itself nor at any of its four direct callers in ip_input.c (lines 1780 [bad IP options], 2030 [TTL exceeded], 2037 [host unreachable], 2184 [PMTUD]).

Mechanism

1. An unprivileged user opens a UDP socket and installs a malformed IPOPT_TS (timestamp) IP option via setsockopt(IP_OPTIONS) — no privilege required.
2. The user floods sendto() to 127.0.0.1 (port 9999, no listener).
3. Each packet loops back through ip_input() → ip_dooptions() (sys/netinet/ip_input.c:1779 goto bad) → icmp_error(m, type, code, 0, 0) at ip_input.c:1780.
4. icmp_error() (sys/netinet/ip_icmp.c:145) generates an ICMP error packet and calls icmp_reflect() to emit it. At no point does badport_bandlim() get called, so the icmplim=200/sec cap is never enforced on this path.

Reproduction evidence

On DragonFly 6.5-DEVELOPMENT #0 (unpatched):

=== icmplim = 200 (per-sec cap that SHOULD apply but doesn't) ===
=== sending 2000 bad-IP-option packets as unpriv user ===
DF-0518: 2000 sendto() in 0.0209s (95558/s)
=== tcpdump summary ===
2200 packets received by filter          <-- in <0.1s!
0 packets dropped by kernel
icmplim (per-sec cap that SHOULD apply):   200
ICMP errors emitted during the ~0.02s burst: 2200
*** DF-0518 REPRODUCED: 2200 ICMP errors emitted in <1s,
    far exceeding icmplim=200.  icmp_error() has no rate-limit.

A second tcpdump -vv capture on lo0 confirms each call to icmp_error() emits exactly one ICMP 127.0.0.1 udp port 9999 unreachable packet, and the emission rate is unbounded.

Impact ceiling

• Local unpriv user: can saturate lo0 with self-generated ICMP errors at ~50 kpps (no rate cap). Local DoS only on the loopback interface.
• Remote spoofed attacker (the realistic threat): a router / forwarding box (net.inet.ip.forwarding=1) emits unlimited ICMP errors back toward a spoofed source via the four direct ip_input.c callers (bad-options / TTL-exceeded / host-unreach / PMTUD). Reflection/amplification factor ~1x (errors quote header +8 bytes), saturates egress, classic DoS vector.
• No memory corruption, no info leak, no privilege escalation — this is a defense-in-depth / hardening gap.

Fix

fix.diff adds a badport_bandlim(BANDLIM_ICMP_UNREACH) check at the top of icmp_error() (mirroring the existing pre-checks at the UDP caller and the ICMP_ECHO/TSTAMP reply paths). All error ICMP emissions are now subject to the icmplim cap uniformly; redirects (which are not "errors") are excluded, matching the existing icps_error accounting.

Build / run

ssh dfbsd-maxx 'mkdir -p poc/DF-0518'
scp findings/poc/DF-0518/{df0518.c,build.sh,run.sh} dfbsd-maxx:poc/DF-0518/
ssh dfbsd-maxx 'cd poc/DF-0518 && sh ./build.sh && sh ./run.sh 2000'
# (run.sh needs root once to invoke tcpdump; the actual packet flood
#  is from the unprivileged maxx socket)

Fix validation (Phase 8) — VALIDATED

Built a single-fix kernel with only the ip_icmp.c patch applied and re-ran the PoC. The fix closes the bug:

• Baseline (#0 unpatched): 5000 sendto() in 0.02s → 2200 ICMP errors emitted in <0.1s on lo0, no rate-limit message in dmesg.
• Patched (#1, kern.version Sat Jul 18 18:28:41 UTC 2026): same PoC → Limiting icmp unreach response from 5100 to 200 packets per second in dmesg; icps_error counter climbs by exactly 200/s; badport_bandlim bucket 0 (BANDLIM_ICMP_UNREACH) now covers the error path.

Patched kernel: 6.5-DEVELOPMENT #1: Sat Jul 18 18:28:41 UTC 2026
SHA256 (/boot/kernel/kernel) = d5c61726925fff0fe2c652b0b4891507998ffc9c0be46fa84423e5b60ff28f03
dmesg: Limiting icmp unreach response from 5100 to 200 packets per second

The other four findings (DF-0503, DF-0510, DF-0513, DF-0521) had their fix.diffs verified to (a) apply cleanly with git apply --check, and (b) compile cleanly as modules on the patched source tree (ip6fw.ko, ng_ksocket.ko v1, ng_ksocket.ko ng7 all built rc=0). Their fixes are not runtime-validated here because their bugs are either latent (root-only / defense-in-depth) or race-window-dependent.