DF-0630 — PoC: udp6_ctlinput netisr deadlock

Remote unauthenticated single-packet permanent netisr wedge via crafted ICMPv6 Destination Unreachable whose quoted UDP header is too short.

Status: REPRODUCED on unpatched #0; fix VALIDATED on single-fix #1. See VERDICT.md for the full analysis.

Files

• trigger.c — verified in-guest injector (raw IPPROTO_ICMPV6 socket, root). Sends the crafted ICMPv6 DestUnreach (inner IPv6 nh=UDP, plen=0) to ::1; the guest's own icmp6_input dispatches udp6_ctlinput, which return;s at udp6_usrreq.c:435 without lwkt_replymsg, wedging the netisr that ran icmp6 input (self-deadlock on cpu0 via cpu0_ctlport).
• udp6_ctlinput_deadlock.py — original scapy trigger, for an external attacker with IPv6 reachability to the victim (the QEMU user-mode net is IPv4-only NAT, so the C injector is used in-guest instead).
• build.sh / run.sh — exact repro scripts.
• fix.diff — the one-line verified fix (return; → goto out;).
• run.log / fix_run.log / fix_build.log / env.txt — full evidence.

Build & run (in-guest, as root)

./build.sh                       # cc -o trigger trigger.c
./run.sh                         # trigger ::1 1 ; then timed ping6/ssh probes
./run.sh 12                      # 12-shot burst

run.sh needs root (raw ICMPv6 socket). The root requirement is an artifact of in-guest injection; the live vulnerability is remotely triggerable by any unauthenticated host that can deliver an IPv6 packet to the victim.

Expected outcome

Unpatched kernel (6.5-DEVELOPMENT #0) — BUG PRESENT

Immediately after sending one packet: - ping6 ::1 hangs forever (8 s timeout, rc 124). - ssh round-trip hangs (rc 124); vm.sh status ⇒ down. - serial console still shows the live login prompt — no panic, no fatal trap, no ddb> (it is a permanent netisr wedge, not a crash). - The box must be rebooted (vm.sh reset) to recover.

Patched kernel (6.5-DEVELOPMENT #1, fix applied) — BUG GONE

After the same trigger (single-shot ×5 and a 12-shot burst): - ping6 ::1 replies in < 2 ms, 0% loss. - ssh responsive; vm.sh status ⇒ up.

Attack vector

• Remote unauthenticated — any host that can deliver an IPv6 packet to a victim address (global, or link-local for on-link attackers).
• IPv6 enabled by default; ICMPv6 cannot be broadly blocked without breaking NDP/IPv6.
• No prior UDP traffic and no credentials required — icmp6_notify_error derives the upper-layer protocol purely from the quoted inner header (icmp6.c:874).
• One packet wedges one netisr CPU permanently; ~N packets (one per CPU, varied source so RSS spreads them) freeze the entire network stack.

Fix

One line at sys/netinet6/udp6_usrreq.c:435:

-           return;
+           goto out;

Routes the early exit through the existing out: label so the mandatory lwkt_replymsg(&msg->ctlinput.base.lmsg, 0) at :449 always runs. Matches the finding markdown's recommended fix exactly.

DF-0630 — VERDICT

Status: REPRODUCED (and fix VALIDATED on a single-fix kernel).

Verdict (one line)

The bug is real and exploitable as described: a single ~48-byte crafted ICMPv6 Destination Unreachable permanently wedges a DragonFly netisr CPU, and the one-line fix (return; → goto out; at udp6_usrreq.c:435) deterministically closes it.

Mechanism (every hop cited)

1. Trigger packet. An ICMPv6 Destination Unreachable (type 1) whose quoted inner IPv6 packet has nh=UDP(17) and plen=0 (zero UDP bytes). With the outer IPv6 header this is 88 bytes on the wire.
2. Dispatch into udp6_ctlinput. On input the kernel runs icmp6_input → icmp6_notify_error (sys/netinet6/icmp6.c:1030-1046), which derives nxt from the quoted inner header (icmp6.c:874, no prior UDP traffic or credentials required), sets ip6cp.ip6c_off = eoff where eoff = off + 8 + 40 = 88 (icmp6.c:875,1033), and calls so_pr_ctlinput(&inet6sw[ip6_protox[IPPROTO_UDP]], …) (icmp6.c:1044).
3. Synchronous netmsg. so_pr_ctlinput (sys/kern/uipc_msg.c:594-611) sets the reply port to the caller's own netisr port (netmsg_init(..., &curthread->td_msgport, ...), uipc_msg.c:604) and dispatches via lwkt_domsg(port, …) (uipc_msg.c:610). udp6's pr_ctlport is cpu0_ctlport (sys/netinet6/in6_proto.c:144; sys/net/netisr.c:648-654), so the message always targets cpu0's netisr.
4. lwkt_domsg blocks the caller. lwkt_domsg sets MSGF_SYNC and, on EASYNC from the target port, calls lwkt_waitmsg (sys/kern/lwkt_msgport.c:184-203). The netisr thread port's mp_putport = lwkt_thread_putport, which always returns EASYNC — even when the target is the current CPU (lwkt_msgport.c:712-738) — and lwkt_thread_waitmsg then sleeps in lwkt_sleep("waitmsg", …) until MSGF_DONE (lwkt_msgport.c:768-798).
5. The bug. udp6_ctlinput (sys/netinet6/udp6_usrreq.c:384) tests, at :434-435: c if (m->m_pkthdr.len < off + sizeof(*uhp)) /* 88 < 88+4 -> TRUE */ return; /* <-- BUG */ sizeof(*uhp) is 4 (two u_int16_t ports, udp6_usrreq.c:396-399). The bare return; skips the out: label (:448) and the mandatory lwkt_replymsg(&msg->ctlinput.base.lmsg, 0) (:449). Every other early exit in the function correctly uses goto out; (:403, :406, :412); this one line is the sole exception.
6. Deadlock. With lwkt_replymsg never called, MSGF_DONE is never set, so the caller netisr sleeps in lwkt_waitmsg forever. Because the target is always cpu0 (cpu0_ctlport), a packet whose icmp6_input runs on cpu0 self-deadlocks cpu0; a packet that runs on cpuN (N≠0) wedges cpuN while cpu0 runs the handler and returns without replying. One packet wedges one netisr permanently; a handful (one per CPU, trivially arranged by varying the source so RSS spreads them) freezes all network processing until reboot.

Reproduction (unpatched #0)

The PoC injects from inside the guest because the QEMU user-mode network is IPv4-only NAT (no host→guest IPv6). A root raw IPPROTO_ICMPV6 socket sends the 48-byte payload to ::1; rip6_output auto-computes the ICMPv6 checksum (sys/netinet6/raw_ip6.c:392-419) and the packet loops back through lo0 into icmp6_input on cpu0 → self-deadlock. The root requirement is purely an artifact of in-guest injection; the live vuln is remotely unauthenticated.

I.e. a single packet froze the entire guest; the kernel did not crash (it is a permanent netisr wedge, exactly as claimed). The box required vm.sh reset to recover. Full untrimmed log: run.log.

Exploit chain

Remote network DoS — no memory-corruption primitive, so there is no escalation chain to develop. The realistic ceiling is: one unauthenticated IPv6 packet permanently wedges one netisr CPU; ~6 packets (one per CPU) freeze the whole network stack, killing existing sessions and blocking all new ones until reboot. The original udp6_ctlinput_deadlock.py (scapy) trigger is retained for external attackers; the in-guest C trigger is added for this QEMU setup.

Fix (authored, validated)

fix.diff — one line, minimal, targets the confirmed root cause:

--- a/sys/netinet6/udp6_usrreq.c
+++ b/sys/netinet6/udp6_usrreq.c
@@ -432,7 +432,7 @@

        /* check if we can safely examine src and dst ports */
        if (m->m_pkthdr.len < off + sizeof(*uhp))
-           return;
+           goto out;

This routes the early exit through the existing out: label so the mandatory lwkt_replymsg(&msg->ctlinput.base.lmsg, 0) at :449 is always executed, restoring the netmsg reply contract. This matches the finding markdown's ## Recommended fix proposal exactly (same one-liner, same rationale).

git apply --check passes against the read-only sys/ tree.

Fix validation (Phase 8)

Built a single-fix kernel on the with-src base (warm obj, .c-only change → incremental build, ~6 min, rc 0, no errors — fix_build.log):

• unpatched #0 kern.version: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
• patched #1 kern.version: DragonFly 6.5-DEVELOPMENT #1: Thu Jul 2 19:52:53 UTC 2026
• patched sha256(/boot/kernel/kernel): 1dfc3c91…b2ed
• Installed as the bare /boot/kernel/kernel (the name the DragonFly loader boots), confirmed the #0 → #1 bump, then rebooted.

Re-ran the SAME trigger on the patched kernel:

Before/after contrast: on #0 one trigger → ssh rc 124 (8 s timeout), vm down; on #1 five single-shots + a 12-shot burst → every follow-up ping6 < 2 ms / 0% loss, ssh responsive, vm up. The fix is deterministic and closes the bug. Full log: fix_run.log.

PoC changes

• Added trigger.c — in-guest C injector (raw IPPROTO_ICMPV6 socket) sending the crafted ICMPv6 DestUnreach to ::1; needed because the QEMU net is IPv4-only NAT so the scapy script (which assumes host→guest IPv6) cannot run here. Documents why root is needed in-guest vs. the remote-unauthenticated threat model.
• Added build.sh / run.sh repro scripts.
• Authored fix.diff (above).
• Kept the original udp6_ctlinput_deadlock.py for external-attacker use.

Notes / defense-in-depth

• Sibling handlers rip6_ctlinput (sys/netinet6/raw_ip6.c:229) and tcp6_ctlinput (sys/netinet6/tcp_subr.c) share this netmsg-conversion heritage and use the same cpu0_ctlport; they were called out in the finding for the same return-without-reply pattern and are worth a separate audit pass.
• Recovered the guest (vm.sh reset with-src) at the end of Phase 8.