NGM_CISCO_GET_IPADDR response sized with sizeof(ips) (pointer) instead of sizeof(*ips) (struct)

LATENT on all currently-supported DragonFlyBSD architectures. DragonFlyBSD only builds for x86_64 (sys/platform/{pc64,vkernel64}, sys/cpu/x86_64), where sizeof(struct ng_cisco_ipaddr *) = sizeof(struct ng_cisco_ipaddr) = 8 bytes, so the buffer is correctly sized by accident. This is a correctness/hardening defect that becomes a 4-byte heap overflow on any 32-bit port or any future arch where sizeof(void*) != sizeof(struct ng_cisco_ipaddr). Same typo class as DF-0608 (netgraph7 ng_iface.c:487).

Summary

The NGM_CISCO_GET_IPADDR handler allocates the response data buffer using sizeof(ips) where ips is struct ng_cisco_ipaddr * — i.e. it sizes the buffer by the pointer width, not by the pointed-to struct. The code then writes a full struct ng_cisco_ipaddr (8 bytes: ipaddr + netmask) into it.

Root cause

sys/netgraph/iface/ng_iface.c:697-710:

697:    struct ng_cisco_ipaddr *ips;                              /* pointer */
...
701:    NG_MKRESPONSE(resp, msg, sizeof(ips), M_NOWAIT);          /* sizeof(pointer) = 8 on amd64, 4 on i386 */
...
706:    ips = (struct ng_cisco_ipaddr *)resp->data;
707:    ips->ipaddr = ((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;   /* offset 0, 4 bytes */
709:    ips->netmask = ((struct sockaddr_in *)ifa->ifa_netmask)->sin_addr; /* offset 4, 4 bytes */

struct ng_cisco_ipaddr (sys/netgraph/cisco/ng_cisco.h:64-67) is exactly 8 bytes (two struct in_addr).

• Compare line 649 for GET_IFNAME which correctly uses sizeof(*arg).
• Compare ng_cisco.c:286-296 which correctly uses 2 * sizeof(*ips) for the same logical operation.

The correct expression here is sizeof(*ips).

Threat model & preconditions

• Currently no security impact: DF's only supported arch is x86_64 where pointer width = struct width = 8 bytes, the buffer is M_ZERO'd by NG_MKRESPONSE, and arglen is set to 8 so userspace reads exactly the right amount.
• If DF ever revives i386 (it had i386 support until v4.x), or if struct ng_cisco_ipaddr grows padding/fields, this becomes a 4-byte heap overflow into M_NETGRAPH, controllable from any local user holding an NG_CONTROL socket.

Recommended fix

Use sizeof(*ips) consistently with the rest of the file.

--- a/sys/netgraph/iface/ng_iface.c
+++ b/sys/netgraph/iface/ng_iface.c
@@ -698,7 +698,7 @@ ng_iface_rcvmsg(node_p node, struct ng_mesg *msg,
                if (ifa->ifa_addr->sa_family != AF_INET)
                    continue;
-               NG_MKRESPONSE(resp, msg, sizeof(ips), M_NOWAIT);
+               NG_MKRESPONSE(resp, msg, sizeof(*ips), M_NOWAIT);
                if (resp == NULL) {
                    error = ENOMEM;

References

• sys/netgraph/iface/ng_iface.c:697,701 — the bug.
• sys/netgraph/iface/ng_iface.c:649 — the correct sizeof(*arg) pattern used elsewhere in the same function.
• sys/netgraph/cisco/ng_cisco.c:286-296 — the correct 2*sizeof(*ips) pattern in the cisco node.
• sys/netgraph/cisco/ng_cisco.h:64-67 — struct ng_cisco_ipaddr (8 bytes).
• DF-0608 — the identical typo in netgraph7 ng_iface.c.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).