Summary

ieee80211_crypto_decap validates the minimum receive frame length against a hardcoded IEEE80211_WEP_MINLEN that uses sizeof(struct ieee80211_frame) (24 bytes) instead of the caller-supplied hdrlen (which can be up to 32 bytes for 4-address frames, or 26-28 for QoS frames). For frames whose actual header is larger than 24 bytes, an attacker-controlled m_pkthdr.len in the gap between the hardcoded minimum (32) and hdrlen + cipher_header causes either (a) m_copydata to walk off the end of the mbuf chain → kernel panic, or (b) m_pullup to fail and free the entire chain, after which the caller does m_freem() on the dangling pointer → double-free / UAF.

Root cause

At ieee80211_crypto.c:587-590:

587:#define IEEE80211_WEP_HDRLEN  (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)    /* = 4 */
588:#define IEEE80211_WEP_MINLEN \
589:    (sizeof(struct ieee80211_frame) + \          /* = 24 */
590:    IEEE80211_WEP_HDRLEN + IEEE80211_WEP_CRCLEN) /* + 4 + 4 = 32 */

Line 598:

598:    if (m->m_pkthdr.len < IEEE80211_WEP_MINLEN) {   /* uses 24, not hdrlen */

This uses sizeof(struct ieee80211_frame) = 24 (ieee80211.h:65-74), but the caller passes the real header length as hdrlen, which ieee80211_hdrspace() computes from the actual frame type. For QoS frames hdrlen is 26 (or 28 with DATAPAD); for 4-address frames it is 30 (or 32). The check admits frames too short for the operations that follow.

Impact 1 — OOB read / panic (m_copydata): Line 613, m_copydata(m, hdrlen + IEEE80211_WEP_IVLEN, sizeof(keyid), &keyid), reads 1 byte at offset hdrlen+3. For 4-address frames (hdrlen=30/32), if m_pkthdr.len is in [32, hdrlen+3], m_copydata walks past the chain end → KASSERT-panic or NULL-deref.

Impact 2 — double-free (m_pullup failure): Lines 624-625, m_pullup(m, hdrlen + cip->ic_header). cip->ic_header is 8 for CCMP/TKIP. For CCMP/TKIP-protected QoS frames where m_pkthdr.len is in [hdrlen+4, hdrlen+7], m_copydata succeeds but m_pullup fails (chain too short). m_pullup frees the chain and returns NULL; the function returns NULL at line 629. The caller still holds the original (now-freed) m pointer (the function takes struct mbuf *m by value and does NOT propagate the new pointer). The caller does if (m != NULL) { ... m_freem(m); } (e.g., ieee80211_hostap.c:905-910) — a double-free.

Threat model & preconditions

• Attacker: an 802.11 radio peer within range of the target AP/station. Associate (open-system auth suffices), wait until PRIVACY is enabled (WPA/WPA2/WEP configured — normal for any secured network), inject a single forged QoS data frame with the Protected bit set and m_pkthdr.len in [32,35]. No valid cryptographic material is needed — the bug fires before any cipher-specific validation.
• Impact: immediate kernel panic (DoS) on INVARIANTS kernels; on production kernels, the double-free corrupts the mbuf objcache — a well-known primitive for kernel code execution.
• Requires physical WiFi hardware (monitor-mode + inject-capable radio) — NOT reproducible in QEMU.

Recommended fix

Use the caller-supplied hdrlen instead of sizeof(struct ieee80211_frame) in the minimum-length check:

--- a/sys/netproto/802_11/wlan/ieee80211_crypto.c
+++ b/sys/netproto/802_11/wlan/ieee80211_crypto.c
@@ -584,12 +584,8 @@ struct ieee80211_key *
 ieee80211_crypto_decap(struct ieee80211_node *ni, struct mbuf *m, int hdrlen)
 {
-#define    IEEE80211_WEP_HDRLEN    (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)
-#define    IEEE80211_WEP_MINLEN \
-   (sizeof(struct ieee80211_frame) + \
-   IEEE80211_WEP_HDRLEN + IEEE80211_WEP_CRCLEN)
    struct ieee80211vap *vap = ni->ni_vap;
    ...
    /* NB: this minimum size data frame could be bigger */
-   if (m->m_pkthdr.len < IEEE80211_WEP_MINLEN) {
+   if (m->m_pkthdr.len < hdrlen + IEEE80211_WEP_IVLEN +
+       IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN) {

This guarantees m_pkthdr.len >= hdrlen + 8, covering both the m_copydata read (needs hdrlen+4) and the largest cipher header (CCMP/TKIP ic_header=8), so m_pullup never fails on this path.

References

• sys/netproto/802_11/wlan/ieee80211_crypto.c:587-598 — the hardcoded minimum-length check.
• sys/netproto/802_11/wlan/ieee80211_crypto.c:613 — m_copydata OOB read.
• sys/netproto/802_11/wlan/ieee80211_crypto.c:624-629 — m_pullup failure → double-free (caller's m not propagated).
• sys/kern/uipc_mbuf.c:2136-2157 — m_pullup failure frees the chain.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).