Cross-reference: The netgraph7 equivalent (sys/netgraph7/ether/ng_ether.c) was audited separately and found to have a High-severity UAF (DF-0617) where the bridge_input_p() return value is discarded. This legacy version does NOT have that UAF — it simply omits the bridge handoff entirely.

Summary

The legacy ng_ether_rcv_upper re-injects upper-hook packets directly into ether_demux() without first consulting the bridge subsystem via bridge_input_p(). The canonical Ethernet input path (ether_input_oncpu) and the netgraph7 equivalent both invoke bridge_input_p() when ifp->if_bridge is set, so that the bridge can consume, forward, or re-attribute the packet. The legacy version omits this entirely, so any packet pushed in through the upper hook on a bridged Ethernet interface is force-delivered to the local protocol stack, bypassing bridge input policy.

Root cause

In sys/netgraph/ether/ng_ether.c:565-587, ng_ether_rcv_upper does:

582:    m->m_pkthdr.rcvif = priv->ifp;
585:    ether_demux(m);

There is no if (priv->ifp->if_bridge) { m = bridge_input_p(...); if (m == NULL) return; } block. Compare the canonical pattern at sys/net/if_ethersubr.c:1245-1259:

1245:   if (ifp->if_bridge) {
1252:       m = bridge_input_p(ifp, m);   /* return CAPTURED */
1253:       if (m == NULL) return;

The netgraph7 version at sys/netgraph7/ether/ng_ether.c:657-661 attempts this handoff but discards the return value (the UAF bug DF-0617). The legacy version simply never acquired the feature.

Threat model & preconditions

• Attacker position: local user who can send data into the ether node's upper hook (typically requiring root to construct the netgraph topology via ngctl, or operating inside a topology an admin has already wired to an accessible data socket).
• Trigger: inject raw Ethernet frames via the upper hook on a bridged interface. The frames reach the local IP/IP6/ARP stack as if received on a specific bridge member, without bridge_input() ever seeing them.
• Impact: bypass of layer-2 bridge isolation/filtering for those frames. No memory corruption, no UAF, no OOB — only a policy bypass. Constructing the injection path itself requires privilege.

Recommended fix

Mirror the canonical ether_input_oncpu pattern, capturing the bridge_input_p() return value (unlike netgraph7, which is the buggy version to avoid):

--- a/sys/netgraph/ether/ng_ether.c
+++ b/sys/netgraph/ether/ng_ether.c
@@ -580,6 +581,16 @@ ng_ether_rcv_upper(node_p node, struct mbuf *m, meta_p meta)

    m->m_pkthdr.rcvif = priv->ifp;

+   /*
+    * Give the bridge a chance to consume/forward/re-attribute this
+    * packet, exactly as ether_input_oncpu() does for the normal path.
+    */
+   if (priv->ifp->if_bridge != NULL && bridge_input_p != NULL) {
+       m = bridge_input_p(priv->ifp, m);
+       if (m == NULL)
+           return (0);
+   }
+
    /* Route packet back in */
    ether_demux(m);
    return (0);

The critical detail is m = bridge_input_p(...) — the assignment must be present so that a NULL return (bridge consumed the mbuf) is observed before ether_demux touches it.

References

• sys/netgraph/ether/ng_ether.c:582,585 — the missing bridge handoff.
• sys/net/if_ethersubr.c:1245-1259 — the canonical correct pattern.
• sys/netgraph7/ether/ng_ether.c:657-661 — the netgraph7 version that has the UAF (DF-0617) due to discarding the return value.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).