LATENT on amd64. On DragonFlyBSD's only supported platform (x86_64) the overflow lands in 7 bytes of intra-struct padding between outbuf and the 8-byte-aligned stats member, so no observable data corruption occurs. It is undefined behavior and a latent memory-safety defect that would corrupt stats.FramesPlain on any layout without that padding.

Summary

The input-length bound check in ng_pred1_compress uses PRED1_BUF_SIZE*8/9+1+4 = 3645 as the maximum, but Pred1Compress can produce up to ceil(n/8)+n bytes (1 flag byte per group of 8 plus 1 data byte per wrong guess). For inlen=3645 with all guesses wrong, the output is 456+3645 = 4101 bytes, written to priv->outbuf+2 which only has 4094 bytes available — overflowing outbuf by 7 bytes.

Root cause

ng_pred1_compress:397 checks if (inlen > (PRED1_BUF_SIZE*8/9 + 1 + 4)) which evaluates to if (inlen > 3645), allowing inlen=3645. The compressed output is written to priv->outbuf+2 (line 416). outbuf is u_char outbuf[PRED1_BUF_SIZE] (4096 bytes), so outbuf+2 provides only 4094 bytes.

In Pred1Compress (lines 573-589), the worst case (all dictionary guesses wrong) writes 1 flag byte per group of 8 input bytes plus 1 data byte per input byte: total = ceil(inlen/8) + inlen. For inlen=3640: 455+3640 = 4095 > 4094 (overflow by 1). For inlen=3645: 456+3645 = 4101 > 4094 (overflow by 7).

The check's +1+4 terms appear to attempt accounting for rounding and header/FCS overhead but do not correctly model either the +2 output offset or the ceiling in the flag-byte count.

The correct maximum safe inlen is 3639 (= (4096-2)*8/9 in integer arithmetic): ceil(3639/8)+3639 = 455+3639 = 4094 exactly.

Threat model & preconditions

• Requires: a pred1 netgraph node configured for compression (root sets this up via ngctl/pppd/mpd).
• Trigger: any local user whose traffic traverses the PPP link with pred1 compression sends a packet of 3640-3645 bytes where dictionary guesses fail. On the first packet after Pred1Init (GuessTable all-zero), sending all-nonzero bytes guarantees every guess is wrong.
• Impact on amd64: overflow corrupts only intra-struct padding — no observable effect. Latent memory-safety defect that becomes real data corruption if struct layout changes.
• Not remotely triggerable: the compress hook processes outbound (local-origin) data only.

Recommended fix

--- a/sys/netgraph7/ng_pred1.c
+++ b/sys/netgraph7/ng_pred1.c
@@ -394,7 +394,7 @@ ng_pred1_compress(node_p node, struct mbuf *m, struct mbuf **resultp)
    priv->stats.InOctets += inlen;

    /* Reserve space for expansion. */
-   if (inlen > (PRED1_BUF_SIZE*8/9 + 1 + 4)) {
+   if (inlen > ((PRED1_BUF_SIZE - 2) * 8 / 9)) {
        priv->stats.Errors++;
        NG_FREE_M(m);
        return (ENOMEM);

References

• sys/netgraph7/ng_pred1.c:397 — the buggy bound check.
• sys/netgraph7/ng_pred1.c:416 — outbuf+2 write offset.
• sys/netgraph7/ng_pred1.c:573-589 — Pred1Compress worst-case output size.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).