NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path: all packets silently dropped
Summary
ng_fec_rcvmsg accepts NGM_FEC_SET_MODE_INET6 sets b->fec_btype=FEC_BTYPE_INET6(:1188-1189). ng_fec_output_serialized switch only handles FEC_BTYPE_MAC and FEC_BTYPE_INET(:810-833). INET6 falls to default: bogus hash type + m_freem(:834-839). Every frame dropped. INET6 cmd nested inside #ifdef INET so no-INET+INET6 build omits command. NOT same as DF-0507(ng7 IPv6 hash XOR self): v1 correctly computes src^dst. Fix: add FEC_BTYPE_INET6 case, de-nest from #ifdef INET.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0531 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 392 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netgraph/fec/ng_fec.c:1180: NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path (packets dropped)
Verified recommended fix
Source-confirmed at sys/netgraph/fec/ng_fec.c:1180: NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path (packets dropped)
Verdict
Source-confirmed at sys/netgraph/fec/ng_fec.c:1180: NGM_FEC_SET_MODE_INET6 sets mode unhandled by output path (packets dropped)
No comments yet.