DF-0521 — PF_LOCAL sockaddr unparse sun_len<pathoff underflow

Verdict: CODE-PATH CONFIRMED (defense-in-depth); latent — no live unprivileged trigger

Mechanism (confirmed at code level)

ng_ksocket_sockaddr_unparse() in sys/netgraph/ksocket/ng_ksocket.c:313-339 converts a struct sockaddr_un to ASCII for netgraph status output. The PF_LOCAL branch at line 321 computes:

const int pathoff = OFFSETOF(struct sockaddr_un, sun_path);  /* = 2 */
const struct sockaddr_un *sun = (const struct sockaddr_un *)sa;
const int pathlen = sun->sun_len - pathoff;       /* SIGNED int! */
char pathbuf[SOCK_MAXADDRLEN + 1];                 /* 256-byte stack buf */

bcopy(sun->sun_path, pathbuf, pathlen);            /* size_t -> ~2^64 */
pathbuf[pathlen] = '\0';                           /* neg-index write */

If sun->sun_len < 2 (i.e. < pathoff), pathlen becomes a negative int. When bcopy interprets it as size_t, it becomes ~2^64, producing a massive OOB write into the 256-byte stack buffer (and a corresponding OOB read from sun->sun_path). pathbuf[pathlen] = 0 then writes at a negative stack offset.

The static df0521 PoC demonstrates the arithmetic:

well-formed: sun_len=14, pathoff=2 -> pathlen=12 (OK)
malformed:  sun_len=1, pathoff=2 -> pathlen=-1
            (size_t)pathlen = 18446744073709551615 bytes
            target buffer:   pathbuf[255+1] (stack)
            pathbuf[pathlen] = '\0' writes at stack offset -1
            => stack OOB write of ~18446744073709551615 bytes + neg-index write

Reachability — why this is defense-in-depth

unparse is invoked by the netgraph subsystem when serializing a sockaddr to ASCII (e.g. for ngctl msg ... getname / getpeername text output). The sockaddr it operates on comes from so_pru_peeraddr / so_pru_sockaddr, which the kernel always fills with a valid sun_len. No path in the kernel currently produces a sockaddr_un with sun_len < 2.

Additionally, the netgraph control socket itself is root-only:

$ ngctl list
ngctl: socket: Operation not permitted

An unprivileged user cannot even reach the unparse code path — driving ng_ksocket requires socket(AF_NETGRAPH) which needs root. The bug would become live only if (a) some other kernel path produced a malformed sockaddr_un, or (b) netlink-style user-supplied data reached unparse directly. The identical twin in netgraph7 (DF-0509) has the same property.

The sibling helper ng_parse_generic_sockdata_getLength (sys/netgraph/ksocket/ng_ksocket.c:169-177) does guard this case:

return (sa->sa_len < SADATA_OFFSET) ? 0 : sa->sa_len - SADATA_OFFSET;

— the PF_LOCAL special-case unparse simply omits the same guard.

Severity assessment

Medium is appropriate: real code defect with a stack-OOB-write primitive, but gated behind (1) root access to drive netgraph, AND (2) a separate kernel bug to produce the malformed input. Matches the finding's own framing ("Medium (not High like ng7) because v1 ksocket is less commonly deployed and kernel-produced sockaddrs always have valid sun_len").

Fix

fix.diff adds the missing guard, mirroring the existing ng_parse_generic_sockdata_getLength pattern:

const int pathlen = (sun->sun_len < pathoff) ? 0 :
    sun->sun_len - pathoff;

A one-line clamp that eliminates the underflow unconditionally.

Build / run

ssh dfbsd-maxx 'mkdir -p poc/DF-0521'
scp findings/poc/DF-0521/{df0521.c,build.sh,run.sh} dfbsd-maxx:poc/DF-0521/
ssh dfbsd-maxx 'cd poc/DF-0521 && sh ./build.sh && sh ./run.sh'
# prints the underflow arithmetic; no kernel side-effect (defense-in-depth)