Summary

ieee80211_scan_copy_ssid declares nssid as int but only checks the upper bound (nssid > IEEE80211_SCAN_MAX_SSID). A negative nssid bypasses the guard, then nssid * sizeof(ssids[0]) in the memcpy size promotes the negative int to a near-maximal size_t, causing a massive heap overflow from the scan_state's ss_ssid array into adjacent kernel memory and an immediate kernel panic.

Root cause

ieee80211_scan.c:296: int nssid (signed).

Line 298: if (nssid > IEEE80211_SCAN_MAX_SSID) — a signed comparison where -1 > 1 is false.

Line 305: memcpy(ss->ss_ssid, ssids, nssid * sizeof(ssids[0])). When nssid is -1, the expression nssid * sizeof(ssids[0]) promotes int(-1) to size_t(0xFFFFFFFFFFFFFFFF) before multiplying by sizeof(struct ieee80211_scan_ssid)=36, yielding 0xFFFFFFFFFFFFFFDC — approximately 18 exabytes. The destination ss->ss_ssid is a 36-byte fixed array inside the heap-allocated ieee80211_scan_state struct. The memcpy writes past ss_ssid into ss_chans[], ss_next, ss_last, ss_mindwell, and the scan_state private extension, then into adjacent slab objects, and faults on the first unmapped page → fatal kernel page fault.

The ioctl-layer check at ieee80211_ioctl.c:2493 (if (sr->sr_nssid > IEEE80211_SCAN_MAX_SSID)) is also signed, so sr_nssid=-1 passes.

Threat model & preconditions

• Attacker: local root (SIOCS80211 requires caps_priv_check_self(SYSCAP_NONET_WIFI) per ieee80211_ioctl.c:3472, root-equivalent).
• Preconditions: a wireless vap interface that is not in INIT state (has been brought UP, even without association; monitor mode or a vap in SCAN state suffices) and ic_nrunning != 0.
• Impact: immediate kernel panic — guaranteed local DoS. The heap corruption is real but the synchronous page-fault in memcpy precedes any use of the corrupted state, so reliable code execution is speculative.

Recommended fix

Change int nssid to u_int nssid so the upper-bound check catches all values > 1 (including 0xFFFFFFFF which was negative as int).

--- a/sys/netproto/802_11/wlan/ieee80211_scan.c
+++ b/sys/netproto/802_11/wlan/ieee80211_scan.c
@@ -293,7 +293,7 @@ void
 ieee80211_scan_copy_ssid(struct ieee80211vap *vap, struct ieee80211_scan_state *ss,
-   int nssid, const struct ieee80211_scan_ssid ssids[])
+   u_int nssid, const struct ieee80211_scan_ssid ssids[])
 {

Also update the prototype in ieee80211_scan.h and harden the ioctl-layer validation in ieee80211_ioctl.c to reject negative sr_nssid.

References

• sys/netproto/802_11/wlan/ieee80211_scan.c:296,298,305 — the signed parameter, the bypassable check, and the overflow.
• sys/netproto/802_11/wlan/ieee80211_ioctl.c:2493 — the same signed-check weakness in the ioctl path.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).