Cross-reference: The netgraph7 equivalent (sys/netgraph7/tty/ng_tty.c) was audited separately and has a different bug (DF-0636: unlocked outq race). The legacy version does NOT have that outq race — it correctly acquires tp->t_token before queue operations. But it lacks netgraph7's ng_uncallout callout-lifetime fix, leading to this separate UAF/deadlock.

Summary

The legacy ng_tty was never updated with the callout-lifetime fix that netgraph7 received (ng_uncallout + node refcounts + FLG_DIE). ngt_start arms a 1-tick callout whose callback ngt_timeout dereferences the per-node softc before taking tp->t_token; ngt_close frees that softc after only a raw callout_stop, which (per kern_timeout.c) does not interlock a concurrently-executing callback. Closing the tty while output is draining therefore either use-after-frees the softc (kernel panic via the subsequent NULL deref in ngt_start) or deadlocks close() and stalls the softclock softint.

Root cause

ngt_start (ng_tty.c:454-457) schedules callout_reset(&sc->ctimeout, 1, ngt_timeout, sc) whenever the outq is non-empty. ngt_timeout (ng_tty.c:466-476) does:

470:    tp = sc->tp;           /* deref of sc BEFORE token */
472:    lwkt_gettoken(&tp->t_token);
473:    sc->flags &= ~FLG_TIMEOUT;
474:    ngt_start(tp);

The sc deref at line 470 is performed before lwkt_gettoken — the token cannot protect it. ngt_close (ng_tty.c:256-278) acquires tp->t_token at line 261, calls callout_stop(&sc->ctimeout) at line 267, then ng_rmnode→ngt_shutdown→kfree(sc, M_NETGRAPH) at line 558, and sets tp->t_sc=NULL at line 273.

Per kern_timeout.c:1085-1094, non-lock-aided callout_stop "does not interlock against a callout that is in-progress". So if the callback is dispatched while ngt_close holds the token, it blocks on lwkt_gettoken at line 472; ngt_close's callout_stop returns without synchronizing it and proceeds to kfree(sc); the callback then resumes and touches freed memory.

Threat model & preconditions

• Setup: requires root (caps_priv_check_self(SYSCAP_RESTRICTEDROOT) at ng_tty.c:194 to install NETGRAPHDISC).
• Trigger: closing the tty (or TIOCSETD switch away from NETGRAPHDISC) while netgraph output is in flight and the callout is armed or being dispatched.
• Impact: local kernel DoS — either close() blocks forever (deadlock, stalling softclock on the dispatching CPU) or the kernel panics (UAF → NULL deref). Memory-corruption escalation beyond panic is impractical: the freed slab (M_NETGRAPH) is not controllable from an unprivileged position and the only post-free write is a single byte clear (FLG_TIMEOUT=0x0001) at line 473.

Recommended fix

Stop the callout before ngt_close takes tp->t_token (so any in-progress callback can acquire the token and finish), and make ngt_timeout take the softc from tp->t_sc under the token instead of dereferencing the bare sc argument before the token. See the full diff in the finding markdown.

References

• sys/netgraph/tty/ng_tty.c:454-457 — callout_reset arm.
• sys/netgraph/tty/ng_tty.c:470 — tp = sc->tp before token.
• sys/netgraph/tty/ng_tty.c:256-278 — ngt_close callout_stop+kfree.
• sys/kern/kern_timeout.c:1085-1094 — callout_stop does not interlock.
• sys/netgraph7/tty/ng_tty.c:252-257,453-454,464-472 — netgraph7's ng_uncallout fix that legacy lacks.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).