DF-0527 — VERDICT

Verdict: SOURCE-CONFIRMED, NOT REACHABLE AT RUNTIME (blocked by DF-0529)

The bug (confirmed in source)

ng_fec_choose_port() computes the port hash mask from the current port count, but fec_idx is assigned sequentially at addport and never renumbered when a port is removed:

// :896
mask = b->fec_ifcnt == 2 ? 0x1 : 0x3;     // so 'port' may be 0..3
...
// :945-948
TAILQ_FOREACH(p, &b->ng_fec_ports, fec_list) {
    if (port == p->fec_idx)
        break;
}
// :956
if (p->fec_ifstat != 1) { ... }            // p may be NULL here -> DEREF

ng_fec_addport() (:395) sets new->fec_idx = b->fec_ifcnt; b->fec_ifcnt++;. ng_fec_delport() (:463-466) only does TAILQ_REMOVE + kfree(p) + b->fec_ifcnt-- — it does not renumber the surviving ports' fec_idx.

So after a 4-port bundle loses one member (fec_ifcnt 4 → 3, mask stays 0x3), a packet whose XOR hash selects the removed index (e.g. index 3) causes the TAILQ_FOREACH to terminate with p == NULL, and :956 if (p->fec_ifstat != 1) dereferences NULL → panic (page fault / NULL deref). With 4 ports and one removed, ~25 % of flows hit the missing slot.

Why it cannot be triggered at runtime on this guest

Same blocker as DF-0526: choose_port only runs on a live fec interface, and ng_fec_constructor() panics on every node creation (DF-0529), so no fec interface can ever be brought up. Verified empirically; the node is uncreatable even after DF-0529's documented fix (residual constructor panic).

Impact ceiling (latent)

NULL-dereference kernel panic (local DoS). This is a read deref of NULL (p->fec_ifstat), not a controllable write — no escalation primitive.

Exploit chain

none — NULL-deref panic (DoS), not memory corruption.

Fix validation

fix.diff adds if (p == NULL) return(EINVAL); immediately after the TAILQ_FOREACH (:948), so a hash that selects a removed slot bails out instead of dereferencing NULL. Compiles cleanly (RC=0). fix_status = not_testable — the DF-0529 constructor panic prevents creating a node to exercise the path; compile-validated only, traced to close the cited path.

PoC changes

Wrote trigger.sh (creates 4 tap ports, removes one, sends traffic — needs a DF-0529-fixed kernel), build.sh/run.sh, fix.diff. No upstream PoC.