Summary

When a new fragment creates a reassembly queue, frag6_nfragpackets is incremented at line 267 before the kmalloc at line 268. If kmalloc fails (returns NULL at line 270), the code jumps to dropfrag (line 271) without decrementing frag6_nfragpackets. This leaves a phantom count that permanently inflates the global packet counter, reducing the effective maximum number of concurrent reassembly queues by one for the lifetime of the system.

Root cause

At sys/netinet6/frag6.c:263-271:

263:    if (ip6_maxfragpackets < 0)
264:        ;
265:    else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets)
266:        goto dropfrag;
267:    frag6_nfragpackets++;                                    /* incremented BEFORE kmalloc */
268:    q6 = (struct ip6q *)kmalloc(sizeof(struct ip6q), M_FTABLE,
269:        M_NOWAIT | M_ZERO);
270:    if (q6 == NULL)
271:        goto dropfrag;                                   /* jump WITHOUT decrementing */

The dropfrag label (frag6.c:535) does m_freem(m) and returns IPPROTO_DONE — but never executes frag6_nfragpackets--. The label has no knowledge of whether frag6_nfragpackets was incremented. Once inflated to == ip6_maxfragpackets, the check at line 265 (frag6_nfragpackets >= (u_int)ip6_maxfragpackets) blocks all future new-flow reassembly until existing queues drain (TTL expiry or completion), at which point the count drops below the limit again but remains permanently +1 above the true count.

Threat model & preconditions

• Attacker position: unauthenticated remote — can trigger M_NOWAIT kmalloc failure by flooding the target with IPv6 fragments to create memory pressure (exhausting mbufs/clusters).
• Impact: each failure leaks one phantom count into frag6_nfragpackets. However, because the limit check at line 265 uses >= and the leak can produce at most ONE phantom before the check blocks further increments, the practical impact is negligible: the effective queue capacity is reduced from nmbclusters/4 (typically 1024+) to nmbclusters/4 - 1. The phantom persists until reboot.
• This is a resource-accounting correctness defect with marginal DoS amplification, not a memory-safety violation.

Recommended fix

Move the frag6_nfragpackets increment to after the kmalloc success check, so the counter only reflects successfully allocated queue entries:

--- a/sys/netinet6/frag6.c
+++ b/sys/netinet6/frag6.c
@@ -264,11 +264,11 @@ frag6_input(struct mbuf **mp, int *offp, int proto)
        else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets)
            goto dropfrag;
-       frag6_nfragpackets++;
        q6 = (struct ip6q *)kmalloc(sizeof(struct ip6q), M_FTABLE,
            M_NOWAIT | M_ZERO);
        if (q6 == NULL)
            goto dropfrag;
+       frag6_nfragpackets++;

        frag6_insque(q6, &ip6q);

This is safe because frag6_input is serialized on netisr0 (IPv6 hashcheck forces all IPv6 input to CPU 0), so there is no race window between the limit check and the increment.

References

• sys/netinet6/frag6.c:267 — the increment before kmalloc.
• sys/netinet6/frag6.c:270-271 — the failure path that skips the decrement.
• sys/netinet6/frag6.c:265 — the >= check that caps at one phantom.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).