DF-0585 — PoC evidence pack

Reproduces the TAPSIFINFO ifnet-serializer orphan in sys/net/tap/if_tap.c (tapioctl). A confirmed local DoS that permanently wedges a tap(4) interface, requiring a reboot to recover.

Root cause (confirmed in source)

tapioctl() at sys/net/tap/if_tap.c:726 acquires the interface serializer with ifnet_serialize_all(ifp) at line 738 and releases it only at line 832 (ifnet_deserialize_all(ifp)), after the switch. The TAPSIFINFO case (line 742) early-returns EPROTOTYPE at line 745 when tapp->type != ifp->if_type, without releasing the serializer. The lock is orphaned for the lifetime of the interface. Every later ifnet_serialize_all(ifp) then blocks forever — including tapclose() at line 426, so even closing the file descriptor hangs.

Reachability / privilege (verified)

• /dev/tap clone node is created 0600 UID_ROOT/GID_WHEEL (if_tap.c:183-185, if_tap.c:377-378), so opening it requires root or wheel membership at the devfs layer.
• tapopen() (if_tap.c:323-327) additionally requires caps_priv_check(SYSCAP_RESTRICTEDROOT) unless net.link.tap.user_open=1. Even with that sysctl set, the devfs node remains 0600 root:wheel, so an unprivileged user still gets EACCES (confirmed: maxx uid 1001 not in wheel → Permission denied).
• Net: this is a root/wheel-reachable local DoS. The CVSS PR:L in the finding is generous; effective privilege is High (or wheel membership). The defect is still real and worth fixing: a privileged network configuration tool (commonly root, e.g. a VPN/bridge/jail setup helper) can trivially wedge the interface and force a reboot.

Files

• leak_tap_lock.c — minimal trigger (vendored correct 8-byte struct tapinfo; fork-dance so the harness doesn't hang).
• build.sh — cc -Wall -O2 -o leak_tap_lock leak_tap_lock.c.
• run.sh — loads if_tap, runs the trigger, then a fully-detached ifconfig corroboration.
• build.log / run.log / corroborate.log — full logs.
• env.txt — guest environment.
• VERDICT.md — full narrative.
• fix.diff — git-apply-able one-line fix.
• manifest.json — artifact catalog.

Build & run (as root on the DragonFly guest)

./build.sh
./run.sh                # loads if_tap if needed, triggers, corroborates

Note on tap being a module: in X86_64_GENERIC, tap(4) is a KLD module (if_tap.ko), not a static kernel device. The bug and the fix live in if_tap.ko. When validating fix.diff, install BOTH the rebuilt kernel AND the rebuilt /usr/obj/.../net/tap/if_tap.ko to /boot/kernel/if_tap.ko (otherwise kldload if_tap loads the old unpatched module and the wedge reproduces even on a rebuilt kernel).

Expected result (bug present)

[*] TAPSIFINFO returned -1: errno=41 (Protocol wrong type for socket)  [EPROTOTYPE=41]
[*] tapioctl() early-returned at if_tap.c:745 WITHOUT releasing
[*] the ifnet serializer acquired at if_tap.c:738 -> LOCK ORPHANED
[+] ===================================== PROOF =====
[+] child pid <N> still running 3s into its close() call
[+] -> tapclose() is wedged at ifnet_serialize_all() (if_tap.c:426)
[+] -> DF-0585 REPRODUCED: interface permanently wedged

On a FIXED kernel (with fix.diff applied to if_tap.ko) the same binary instead reports the honest negation — the child exits and the serializer is released:

[+] child pid <N> EXITED after close() (status=0x0)
[+] -> tapclose() completed; serializer released
[+] -> DF-0585 NOT reproduced: no wedge (FIXED kernel)

The detection uses waitpid(WNOHANG) (not kill(pid,0), which cannot distinguish a wedged child in D-sleep from an exited zombie).

and the detached corroboration:

BG_PID=<N>
CORROB_IFCONFIG_WEDGED      # ifconfig tap0 still in D-sleep after 6s

After this the tap0 interface (and the stuck kernel thread) are unusable. Recovery requires a reboot (vm.sh reset). This is a destructive hang, not a panic — the guest does not drop to DDB.

How the proof works

The trigger opens /dev/tap (clone → tap0), issues TAPSIFINFO with type=0xFF (≠ IFT_ETHER=6) to hit the buggy early-return at line 745, then forks. The parent drops its file reference first; the child's close() is therefore the final reference, so it runs tapclose() → ifnet_serialize_all(ifp) at line 426, which blocks forever on the orphaned serializer. The parent observes the child is still alive 3 s later and reports PROOF, then exits (leaving the child wedged in the kernel). A fully-detached ifconfig tap0 corroborates that the whole interface (not just this fd) is wedged.

DF-0585 — VERDICT

Verdict: REPRODUCED (local DoS — interface wedge, reboot required) → FIX VALIDATED on single-fix kernel

The bug, confirmed in source

tapioctl() in sys/net/tap/if_tap.c:

726: static int
727: tapioctl(struct dev_ioctl_args *ap)
728: {
...
738:     ifnet_serialize_all(ifp);      <-- acquire interface serializer
739:     error = 0;
740:
741:     switch (ap->a_cmd) {
742:     case TAPSIFINFO:
743:         tapp = (struct tapinfo *)data;
744:         if (ifp->if_type != tapp->type)
745:             return (EPROTOTYPE);    <-- BUG: early return, lock NOT released
746:         ifp->if_mtu = tapp->mtu;
...
830:     }
831:
832:     ifnet_deserialize_all(ifp);    <-- the ONLY release point
833:     return (error);

The serializer acquired at line 738 is released at exactly one place, line 832. The TAPSIFINFO early-return at line 745 bypasses it, orphaning the lock for the lifetime of the interface. The same serializer is re-acquired in tapclose() at line 426, so once the orphan exists the close of the fd — and every other op that serializes the interface — blocks forever.

Trigger & proof (re-confirmed on this run, unpatched #0)

1. open("/dev/tap", O_RDWR) → clone creates tap0.
2. ioctl(fd, TAPSIFINFO, &ti) with ti.type = 0xFF (≠ IFT_ETHER=6) → hits the early return at line 745 → serializer orphaned.
3. Fork; parent drops its fd reference; the child's close() is the final reference → tapclose() → ifnet_serialize_all() at line 426 → blocks forever.

Decisive kernel-side evidence (unpatched #0 + original if_tap.ko):

[+] child pid 858 still running 3s into its close() call
[+] -> DF-0585 REPRODUCED: interface permanently wedged

  PID STAT  WCHAN  COMM
  858 D1    slize  leak_tap_lock      <- child wedged in uninterruptible sleep
                                         on the orphaned ifnet serializer

An independent detached ifconfig tap0 (no shared fd) also wedges in D-sleep on wchan=slize — proving the entire interface is orphaned, not just the triggering fd. Recovery requires a reboot.

Privilege / reachability (verified)

• /dev/tap clone node is 0600 root:wheel (if_tap.c:183); tapopen() (if_tap.c:323) requires caps_priv_check(SYSCAP_RESTRICTEDROOT) unless net.link.tap.user_open=1, and even then the devfs node stays 0600.
• Unprivileged maxx (uid 1001, not in wheel) gets EACCES — confirmed.
• Net: root/wheel-reachable local DoS. Realistic threat model: a privileged network-config helper (VPN/bridge/jail setup, a qemu/bhyve VM process given a tap fd) that is buggy or compromised can wedge the kernel.

Impact

• Class: CWE-667 (lock orphan) → permanent local denial of service.
• Effect: the tap(4) interface becomes unusable; the open fd cannot be closed; ifconfig, RX/TX, module-unload all block forever. Reboot required.
• No panic / no memory corruption → no exploit chain beyond DoS. Impact is dos.

PoC changes from the seeded version

1. The seeded leak_tap_lock.c had a wrong struct tapinfo (16-byte layout). The real struct tapinfo (sys/net/tap/if_tap.h:46) is 8 bytes ({int baudrate; short mtu; u_char type; u_char dummy;}). Because TAPSIFINFO is _IOW('t', 91, struct tapinfo), the ioctl number is derived from sizeof(struct tapinfo); the wrong struct produced the wrong ioctl number → kernel switch fell through to default: ENOTTY, never reaching the buggy path. Fixed by vendoring the correct 8-byte struct.
2. Reworked the proof into a fork-dance (parent drops its ref first so the child's close() is the final close that runs tapclose), so the harness never hangs on the wedge.
3. This run: fixed the wedge detection. The original kill(pid, 0) check cannot distinguish a genuinely-wedged child (D-sleep) from a child that exited and is now a zombie — kill(pid,0) succeeds for both, so the PoC falsely printed PROOF on the FIXED kernel. Replaced it with waitpid(pid, &st, WNOHANG): a reaped child ⇒ close() returned ⇒ serializer released ⇒ FIXED; a still-running child after the probe window ⇒ wedged ⇒ BUG. The PoC now prints honest, opposite verdicts on the two kernels.

Recommended fix — VALIDATED on a built+booted single-fix kernel

Release the serializer on the early-return path. One-line change at if_tap.c:744-747 (see fix.diff):

    if (ifp->if_type != tapp->type) {
        ifnet_deserialize_all(ifp);
        return (EPROTOTYPE);
    }

Fix-validation result: FIXED (clean before/after)

Critical build nuance discovered: in X86_64_GENERIC, tap(4) is a KLD module, not a static kernel device. The bug and the fix live in if_tap.ko, not in the kernel binary. The first fix-validation rebuilt the kernel but left the original Jun-29 if_tap.ko on disk; kldload if_tap then loaded the unpatched module and the wedge reproduced even on the #1 kernel. The correct validation installs both the rebuilt kernel AND the rebuilt if_tap.ko:

• /boot/kernel/if_tap.ko ← patched module (sha256 bfe90971…, 263008 B)
• /boot/kernel/if_tap.ko.orig ← baseline module (sha256 8e1a6da3…, 262320 B)

Built kernel: DragonFly 6.5-DEVELOPMENT #1: Thu Jul 2 16:46:56 UTC 2026 (make -j6 nativekernel KERNCONF=X86_64_GENERIC, rc=0; full log fix_build.log). Confirmed deterministic across 3 runs on the patched kernel. The fix supersedes the finding markdown's error=…; break; proposal (functionally equivalent — both route through the single deserialize — but the applied ifnet_deserialize_all + return is more localized and matches the immediate-acquire/immediate-release style of the surrounding error paths).