Summary

ng_car_schedule divides by hinfo->conf.cir (ng_car.c:656) but SET_CONF only rejects cir==0 when mode==NG_CAR_SHAPE (ng_car.c:483-492). cir==0 is accepted for SINGLE_RATE/DOUBLE_RATE/ RED modes. If a node is reconfigured from SHAPE (which is the only mode that fills the queue and schedules the callout) to one of those modes with cir==0 while the queue is still non-empty, the pending/rescheduled callout divides by zero and panics.

Root cause

Validation in ng_car_rcvmsg SET_CONF (ng_car.c:471-482) checks cir > 1000000000 (upper bound only) and only adds a cir == 0 rejection for NG_CAR_SHAPE (lines 483-487 and 488-492). cir is therefore allowed to be 0 in SINGLE_RATE/DOUBLE_RATE/RED.

The only consumer that divides by cir is ng_car_schedule at ng_car.c:656:

656:    delay = (-(hinfo->tc)) * hz * 8 / hinfo->conf.cir + 1;

ng_car_schedule is reachable from the SHAPE enqueue first-packet path (ng_car.c:761, but that path requires SHAPE which forbids cir==0) AND — critically — from the queue-processing callout ng_car_q_event at ng_car.c:704-706, which reschedules whenever the queue is still non-empty regardless of the current mode:

704:    if (hinfo->q_first != hinfo->q_last)
705:        /* Schedule queue processing. */
706:        ng_car_schedule(hinfo);

Because SET_CONF does not flush an existing queue on reconfiguration, the sequence SHAPE(cir>0, fill queue) → SET_CONF(RED or SINGLE_RATE, cir=0) leaves a non-empty queue with a pending callout and cir==0; the callout fires, drains until q_first != q_last still holds, calls ng_car_schedule, and executes the divide by cir==0 → integer divide-by-zero → kernel panic.

Threat model & preconditions

• Attacker position: requires the netgraph control socket (SYSCAP_RESTRICTEDROOT, root) for both SET_CONF operations, so this is a privileged denial-of-service: a root process (or a compromised root context) issuing a valid-looking reconfiguration sequence panics the kernel.
• No unauthenticated/network vector exists because cir is only writable through the control message path, not the data path.
• Impact: A:H only (panic).

Recommended fix

Reject cir==0 unconditionally (it is the divisor in ng_car_schedule and is nonsensical as a committed rate), and add a defensive guard in ng_car_schedule.

Validation:

--- a/sys/netgraph7/ng_car.c
+++ b/sys/netgraph7/ng_car.c
@@ -471,8 +471,12 @@
            if ((bconf->downstream.cir > 1000000000) ||
+               (bconf->downstream.cir == 0) ||
                (bconf->downstream.pir > 1000000000) ||
                (bconf->upstream.cir > 1000000000) ||
+               (bconf->upstream.cir == 0) ||
                (bconf->upstream.pir > 1000000000) ||

Defense in depth in ng_car_schedule:

@@ -654,6 +654,10 @@ static void
 ng_car_schedule(struct hookinfo *hinfo)
 {
    int     delay;

+   /* cir == 0 would divide by zero; reject defensively. */
+   if (hinfo->conf.cir == 0)
+       return;
+
    delay = (-(hinfo->tc)) * hz * 8 / hinfo->conf.cir + 1;

References

• sys/netgraph7/ng_car.c:656 — the divide by conf.cir.
• sys/netgraph7/ng_car.c:471-492 — SET_CONF validation that only rejects cir==0 for SHAPE.
• sys/netgraph7/ng_car.c:704-706 — ng_car_q_event reschedules regardless of mode.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).