DF-0612 — PoC: ieee80211_parse_tdma() join-path heap OOB write via setbit()

Unauthenticated adjacent-network (WiFi) heap OOB write PoC.

Status — VERIFIED (code-level) + FIX VALIDATED

The bug is real and present in the default GENERIC kernel (ieee80211_parse_tdma is compiled directly into /boot/kernel/kernel). The live 802.11 receive/join path is unreachable on this QEMU guest (only vtnet0/lo0, no WiFi radio, no wlan module loaded). Per the per-PoC procedure, a deterministic code-level harness (harness.c) replicates the exact kernel structs and the buggy setbit() line and proves the OOB; a binary-level before/after on the actual shipped kernel proves the fix (VERDICT.md, logs/*.disasm). The inject_tdma_beacon.py injector is kept for real WiFi hardware (not runnable on QEMU).

The fix was validated end-to-end: fix.diff applied to in-guest /usr/src, make -j6 nativekernel built a single-fix kernel (#1, sha 8048ccf4…), installed + rebooted; ieee80211_parse_tdma in the booted kernel now contains the length guard (cmp $0x15) and slot guard (cmp $0x1) and the harness's OOB case is blocked. See VERDICT.md and fix_run.log.

Files

• inject_tdma_beacon.py — scapy-based beacon injector carrying a forged TDMA vendor IE with tdma_slot=64 (OOB). When a DragonFlyBSD TDMA-mode vap selects this forged BSS as a join candidate, ieee80211_parse_tdma() runs setbit(ts->tdma_inuse, 64) which writes at ts->tdma_inuse[8] — 8 bytes past the 1-byte tdma_inuse[] array — corrupting the tdma_peer pointer in struct ieee80211_tdma_state.

Build & run

There are two artifacts:

1. harness.c — a self-contained, deterministic userspace harness (runnable on this guest) that replicates the exact kernel struct layouts (verbatim header) and the buggy setbit() line. It proves the OOB write for several crafted IEs (slot=64 hits tdma_peer; slot=8 hits tdma_active; slot=255 hits tdma_lastprint) and the secondary short-IE OOB read, and shows the FIXED-function variant rejects them. This is what reproduces on QEMU.

Build (guest, as root — needs /usr/src for the header): ./build.sh # or: cc -O2 -Wall -o harness harness.c (with the header in -I) ./run.sh # or: ./harness Expected: prints OOB WRITE CONFIRMED for the UNFIXED cases and FIX HOLDS / OOB write confirmed on UNFIXED, blocked on FIXED.

2. inject_tdma_beacon.py — the live-frame injector for real WiFi hardware. Not reproducible in QEMU.

The victim host must have a TDMA-mode vap that is scanning for SSID:

ifconfig wlanX create wlandev ath0 wlanmode adhoc tdmaslot 1
ifconfig wlanX up scan            # triggers ieee80211_parse_tdma on join

Expected outcome

• TDMA link desynchronization,
• the victim's beacons carry a corrupted tdma_inuse mask,
• the active-slot refresh cadence (tdma_count) is disrupted.

With SLOT values in 32..63 the master's slot-mask refresh stalls or fires every beacon.

Slot-to-offset table

(Struct layout per sys/netproto/802_11/ieee80211_tdma.h:67-87.)

Notes for the per-PoC verifier

• Cannot be reproduced in QEMU (no physical WiFi radio). The runner should confirm the code path statically: ieee80211_sta_join (ieee80211_node.c:798) -> ieee80211_ies_expand (:833) -> ieee80211_parse_tdma (:848) -> setbit (ieee80211_tdma.c:657).
• If a net80211 loopback/inject test harness exists in-tree, feed the crafted IE directly to the join path.
• The fix adds the same IE-length and tdma_slot >= TDMA_MAXSLOTS guards that tdma_process_params() (:536,:555) already has. Verify with git apply findings/poc/DF-0612/fix.diff.

DF-0612 — VERDICT

Finding: ieee80211_parse_tdma() join path skips IE-length and tdma_slot validation → heap OOB write via setbit() from a crafted TDMA vendor IE. File: sys/netproto/802_11/wlan/ieee80211_tdma.c:644-669

Verdict: REPRODUCED (code-level) — fix VALIDATED on a single-fix kernel

The bug is real and present in the default GENERIC kernel (nm /boot/kernel/kernel shows ieee80211_parse_tdma as a T symbol, compiled in directly). The sibling handler tdma_process_params() guards the same setbit() with an IE-length check (ieee80211_tdma.c:536) and a tdma_slot range check (:555); ieee80211_parse_tdma() has neither.

The live 802.11 receive/join path is unreachable on this QEMU guest (only vtnet0/lo0, no WiFi radio, no wlan module loaded), so the bug cannot be triggered end-to-end here. Per the per-PoC procedure, a deterministic code-level harness that replicates the exact kernel struct layouts and the exact buggy line is used to prove the primitive, and a binary-level before/after on the actual shipped kernel proves the fix.

Mechanism (trigger → primitive → effect), path:line

• ieee80211_node.c:848 — join path: if (ni->ni_ies.tdma_ie != NULL) ieee80211_parse_tdma(ni, ni->ni_ies.tdma_ie); (guarded by IEEE80211_SUPPORT_TDMA).
• ieee80211_tdma.c:650-652 — casts attacker IE directly to const struct ieee80211_tdma_param *, fetches ts = vap->iv_tdma.
• ieee80211_tdma.c:657 — the buggy line: setbit(ts->tdma_inuse, tdma->tdma_slot); with no prior validation.
• sys/param.h:390 — #define setbit(a,i) ((a)[(i)/NBBY] |= 1<<((i)%NBBY)), NBBY=8.
• ieee80211_tdma.h:73 — uint8_t tdma_inuse[1]; — a 1-byte array.
• ieee80211_tdma.h:54 — tdma_slot is u_int8_t (0..255).

setbit therefore writes at &ts->tdma_inuse[0] + tdma_slot/8, i.e. struct offset 8 + slot/8. Verified struct offsets (__packed-false, x86_64): tdma_inuse@8, tdma_active@9, tdma_count@12, tdma_peer@16, tdma_lastprint@24, tdma_fails@40, function pointers (tdma_newstate etc.)@48.

• slot 0..7 → offset 8 (in-bounds)
• slot 8..15 → offset 9 (tdma_active)
• slot 32..39 → offset 12 (tdma_count)
• slot 64..71 → offset 16 (tdma_peer byte 0)
• slot 248..255 → offset 39 (last byte of tdma_lastprint)

Max reach is offset 39 (slot is u8 → 255/8=31). The function pointers at offset 48 are NOT reachable — this bounds the primitive to TDMA state corruption / protocol-DoS, with no RIP control / no uid0 path.

Secondary bug: because the IE length is never checked, reading tdma->tdma_slot (offset 8), tdma_slotcnt, tdma_slotlen, tdma_bintval, tdma_inuse from a deliberately short IE (the istdmaoui accept test only requires ie[1] > 3) is a heap OOB read within the ies->data blob.

Harness proof (deterministic)

harness.c includes the verbatim kernel header and reproduces the exact setbit(ts->tdma_inuse, tdma->tdma_slot) line. Decisive runs:

[Case 1] slot=64 -> setbit writes tdma_peer byte 0 (offset 16)
    [before] ... tdma_peer=0xdeadbeefcafebabe ...
    [UNFIXED] ... tdma_peer=0xdeadbeefcafebabf ...
    -> tdma_peer changed 0xdeadbeefcafebabe -> 0xdeadbeefcafebabf : OOB WRITE CONFIRMED
[Case 3] slot=8 -> tdma_active[0] = 0x01 : OOB WRITE CONFIRMED  (1 past the array)
[Case 4] short IE (len=6) -> tdma_slot read as 0xab (offset 8) : OOB READ CONFIRMED
[Case 5] FIXED rejects slot=64; tdma_peer UNCHANGED (0xdeadbeefcafebabe): FIX HOLDS
[Case 6] FIXED accepts slot=1 in-bounds; legit path preserved

Binary-level before/after (the fix is in the shipped kernel)

objdump -d --disassemble=ieee80211_parse_tdma:

#0 baseline (Thu Jul 2 06:02:54, sha baseline):

movzbl 0x8(%rsi),%ecx          ; read tdma_slot, NO length check
shr    $0x3,%al ; and $0x1f,%eax
or     %dl,0x8(%rdi,%rax,1)    ; setbit at variable offset 8+(slot/8)  -> OOB

No cmp against ie[1]; no cmp against TDMA_MAXSLOTS.

#1 single-fix (Wed Jul 8 20:37:20, sha 8048ccf4…, built from fix.diff):

movzbl 0x1(%rsi),%r8d ; cmp $0x15,%r8b ; jbe reject   ; len guard: ie[1]<22 -> reject
movzbl 0x8(%rsi),%ecx ; cmp $0x1,%cl   ; jbe accept    ; slot guard: slot>=2 -> reject
... accept path:
or     %al,0x8(%rdx)                                       ; setbit at FIXED offset 8 (slot provably 0..1)

Both guards compiled in; setbit now writes only at fixed offset 8 (the compiler proved slot/8 ≡ 0 for slot ∈ {0,1}). The OOB is eliminated.

Exploit chain / escalation

Not applicable — two valid hard blockers: 1. Reachability blocker: the live path requires a WiFi radio + TDMA vap scanning/joining. This QEMU guest has only vtnet0/lo0; no wlan module is loaded; the path is unreachable here. (On a real DragonFlyBSD TDMA host — e.g. an ath/ath9k long-distance link — it is reachable by an unauthenticated adjacent-network attacker via a spoofed beacon carrying the forged TDMA vendor IE.) 2. Primitive ceiling: even on a real host, the OOB write is bounded to struct offsets 9..39 (slot is u_int8_t, max index 31). It cannot reach the function pointers at offset 48+, so there is no RIP control and no path to uid=0. The realistic impact is TDMA link desynchronization / state corruption (DoS) of the affected TDMA vap, plus a secondary OOB read from a short IE.

Severity Medium (matches the finding): unauthenticated adjacent-network OOB write, deterministic once a forged beacon is selected for join, but bounded to TDMA state and requiring the niche TDMA mode.

PoC changes

• Added harness.c — a faithful userspace replica of the exact kernel struct ieee80211_tdma_state/ieee80211_tdma_param layouts (verbatim header) and the exact buggy setbit(ts->tdma_inuse, tdma->tdma_slot) line (ieee80211_tdma.c:657), plus a FIXED-function variant mirroring the proposed guards. Drives crafted IEs (slot=64/255/8 OOB; short IE OOB read) and demonstrates the corruption and that the fix blocks it.
• The original inject_tdma_beacon.py is kept as the live-frame injector for real WiFi hardware (not runnable on QEMU).
• Added fix.diff — standalone git apply-able unified diff adding the length check (ie[1] < sizeof(*tdma)-2) and slot range check (tdma->tdma_slot >= TDMA_MAXSLOTS) before the setbit, mirroring the sibling guards at :536/:555. git apply --check passes.
• Added build.sh/run.sh repro scripts.

Fix validation (Phase 8) — VALIDATED

• Baseline (#0): harness Case 1 corrupts tdma_peer (...babe→...babf); ieee80211_parse_tdma in /boot/kernel/kernel.debug has no guards.
• Applied fix.diff to in-guest /usr/src, built make -j6 nativekernel KERNCONF=X86_64_GENERIC (fix_build.log, NK_DONE rc=0), make installkernel, rebooted.
• Patched (#1, Wed Jul 8 20:37:20, sha 8048ccf4…): harness Case 5 rejects slot=64, tdma_peer unchanged; ieee80211_parse_tdma in the booted /boot/kernel/kernel.debug now contains cmp $0x15 (length guard) and cmp $0x1 (slot guard) before a fixed-offset or %al,0x8(%rdx).

fix_status: fixed — the OOB write present in the #0 kernel is gone in the

1 single-fix kernel; legit in-range slots (0..1) still work.

Recommended fix

The fix in fix.diff matches the finding markdown's proposal (same two guards, same IEEE80211_DISCARD_IE style as the sibling). One minor refinement over the finding's diff: the slot-range reject branch also emits an IEEE80211_DISCARD_IE (matching tdma_process_params:556-558) rather than a bare return, for observability.

Environment

• Guest: DragonFly 6.5-DEVELOPMENT x86_64, gcc 8.3 (DragonFly).
• Interfaces: vtnet0 lo0 only — no WiFi radio; wlan module not loaded.
• ieee80211_parse_tdma is compiled directly into /boot/kernel/kernel (default X86_64_GENERIC), so the vulnerable code ships by default; only the live trigger path is absent on this guest.