DF-0601 — PoC: (none — file is orphaned/non-compiling)

No PoC can be built today. sys/netgraph7/ng_source.c is not listed in sys/conf/files and has a compile error at line 742 (ifq undeclared; should be ifsq). The file is dead, non-compiling code; the race defect is latent and would only become reachable if a maintainer fixes the typo and adds the file to the build.

See findings/DF-0601-ng7-source-rcvdata-no-force-writer-race.md for the analysis and the fix diff. The PoC sketch in the finding markdown covers the steps that would reproduce the race once the file is re-animated.

DF-0601 — VERDICT: NOT REPRODUCED (latent: file is dead, orphaned, non-compiling code)

Verdict

NOT REPRODUCED — latent hardening item. The race condition described in the finding is statically correct (every source-level claim verified below), but the file sys/netgraph7/ng_source.c is dead, orphaned, and non-compiling code that cannot be reached on any currently-buildable DragonFlyBSD kernel configuration. There is no triggerable primitive, no panic, no leak — the bug is a latent defect that would only become live if a maintainer re-animates the file (fixes the compile typo, adds it to conf/files, adds a NETGRAPH7_SOURCE option, enables NETGRAPH7 in a kernel config). The finding is correctly filed as Info severity.

Why it cannot reproduce — exhaustive dead-code proof

The finding's own caveat (lines 17-37 of the finding markdown) is fully confirmed by source tracing:

(1) ng_source.c is NOT in the build system

$ grep -rn ng_source sys/conf/
(empty — no match in any conf/ file)
$ grep -n "netgraph7" sys/conf/files | grep source
(empty — every other ng7 node IS listed, ng_source is conspicuously absent)
$ grep -n "NETGRAPH7_SOURCE" sys/conf/options
(empty — there is no such option; all ~50 other ng7 node types have one)

Even if a maintainer added options NETGRAPH7_SOURCE to a kernel config, the build would not compile the file because conf/files has no netgraph7/ng_source.c entry.

(2) The file has a hard compile error at line 743

Inside ng_source_intr (ng_source.c:726), the only local in scope at line 743 is ifsq (declared at lines 740-741 via ifq_get_subq_default). Line 743 references the undeclared identifier ifq:

739:    if (sc->output_ifp != NULL) {
740:        struct ifaltq_subqueue *ifsq =
741:            ifq_get_subq_default(&sc->output_ifp->if_snd);
742:
743:        packets = ifq->ifq_maxlen - ifq->ifq_len;   /* BUG: ifq undeclared */
744:    } else

This is a guaranteed error: 'ifq' undeclared compile failure. The file cannot be compiled as-is.

(3) The default kernel does not enable NETGRAPH7 at all

$ grep -in netgraph sys/config/X86_64_GENERIC
(empty)

The default X86_64_GENERIC kernel has no options NETGRAPH7 line, so netgraph7/netgraph/ng_base.c (the framework dispatcher, listed as optional netgraph7) is not compiled into the kernel. The guest confirms: nm /boot/kernel/kernel | grep netgraph7 returns nothing, and kldload netgraph7 fails with "No such file or directory".

(4) No ng_source module exists on the guest

guest$ ls /boot/kernel/ | grep source    (empty)
guest$ find sys/ -name "*ng_source*"     → only sys/netgraph7/ng_source.{c,h}

Neither old netgraph (sys/netgraph/) nor netgraph7 has a loadable/compiled ng_source on this guest.

Static analysis — all 4 source claims verified (the bug IS real if re-animated)

Despite being dead code, the race-condition observation is correct:

Claim 1: Constructor lacks NG_NODE_FORCE_WRITER ✅

ng_source_constructor (ng_source.c:269-284) sets sc->snd_queue.ifq_maxlen and calls ng_callout_init, but never calls NG_NODE_FORCE_WRITER(node). Compare sibling nodes that correctly force writer serialization:

Claim 2: rcvdata uses unlocked _IF_ENQUEUE ✅

ng_source_rcvdata (ng_source.c:545-570) mutates shared state with no lock:

565:        _IF_ENQUEUE(&sc->snd_queue, m);      /* unlocked macro */
566:        sc->queueOctets += m->m_pkthdr.len;  /* plain racy assignment */
567:        sc->last_packet = m;                 /* plain racy assignment */

_IF_ENQUEUE is the unlocked variant — it does if (ifq->ifq_tail == NULL) ifq->ifq_head = m; else ifq->ifq_tail->m_nextpkt = m; ifq->ifq_tail = m; with no atomicity.

Claim 3: Framework dispatches data as readers without FORCE_WRITER ✅

The netgraph7 dispatch (ng_base.c:1993-1999) checks NGF_FORCE_WRITER:

1993:   if (((item->el_flags & NGQF_RW) == NGQF_WRITER) ||
1994:       (node->nd_flags & NGF_FORCE_WRITER) ||
1995:       (hook && (hook->hk_flags & HK_FORCE_WRITER))) {
1996:       ng_acquire_write(node);       /* exclusive: lwkt_gettoken */
1997:   } else {
1998:       ng_acquire_read(node);        /* shared: lwkt_gettoken_shared */
1999:   }

Data items are created as readers by default (ng_base.c:2994: item->el_flags |= NGQF_READER). Without NG_NODE_FORCE_WRITER, ng_source's rcvdata runs under ng_acquire_read → lwkt_gettoken_shared (ng_base.c:1845), which permits concurrent execution across CPUs.

Claim 4: _IF_ENQUEUE is non-atomic → race on snd_queue linkage ✅

Two concurrent rcvdata invocations can both read ifq_tail==NULL (losing one packet's linkage) or both write ->m_nextpkt of the same tail (corrupt chain). The same snd_queue is later dequeued by ng_source_send/ng_source_intr via _IF_DEQUEUE (lines 671, 789), so a corrupted chain yields panic or double-free.

Classification

This is Phase 4 case (d): genuinely not reachable on this kernel — and stronger: not reachable on ANY buildable kernel because the file is not in the build system and has a pre-existing compile error. This is a valid latent defect / hardening item (Info severity), exactly as the finding is filed.

Exploit chain

none — this is a latent race condition in dead code. There is no triggerable primitive, so no escalation chain is possible. This is the valid hard-blocker case: "The vulnerable code path is dead/unreachable at runtime on this guest AND no harness can exercise it" (a race in a netgraph dispatch handler cannot be isolated to a unit-test harness; it requires the full netgraph framework + multi-CPU packet fan-in).

PoC changes

none — no PoC can be built (the finding's README correctly states this). No source files were added or modified. Only fix.diff, VERDICT.md, build.sh, run.sh, env.txt, and manifest.json were added to the evidence pack.

Fix

fix.diff adds NG_NODE_FORCE_WRITER(node) to the constructor — the minimal, targeted hardening fix matching every sibling netgraph7 node. This is a defense-in-depth measure for dead code; it cannot be build-validated because the file is not in conf/files and has the pre-existing ifq typo at line 743.

fix_status: not_testable — the file is dead code (not in the build system, has a compile error, NETGRAPH7 not in GENERIC), so building a single-fix kernel and re-running a PoC is impossible. The diff passes git apply --check (rc=0) and matches the finding's recommended fix exactly.

Before this fix has any effect, a maintainer must also: 1. Fix the ifq→ifsq typo at ng_source.c:743. 2. Add netgraph7/ng_source.c optional netgraph7_source to sys/conf/files. 3. Add NETGRAPH7_SOURCE opt_netgraph.h to sys/conf/options. 4. Enable options NETGRAPH7 + options NETGRAPH7_SOURCE in a kernel config.