Summary

check_from_lookup and check_to_lookup index the per-CPU table_ctx array (allocated as exactly IPFW_TABLES_MAX=32 entries) with cmd->arg1 (uint16_t) without any bounds check. A malformed rule installed via a crafted setsockopt sockopt with arg1 >= 32 reads past the array into adjacent heap. If the leaked type field is nonzero and the leaked node pointer is dereferenceable, rnh_lookup is called on a garbage radix_node_head *, typically causing a kernel panic (DoS).

Root cause

ip_fw3_basic.c:311-318 (check_from_lookup):

311:    table_ctx = ctx->table_ctx;
312:    table_ctx += cmd->arg1;          /* no bounds check — arg1 is uint16_t */
314:    if (table_ctx->type != 0) {      /* OOB read if arg1 >= 32 */
315:        rnh = table_ctx->node;   /* OOB pointer */
318:        if (rnh->rnh_lookup(&sa, NULL, rnh) != NULL)  /* deref garbage */

check_to_lookup (lines 404-411) is identical. The kernel rule installer ip_fw3_ctl_add_rule never validates that a lookup opcode's arg1 is < IPFW_TABLES_MAX.

Threat model

• Privilege: root / SYSCAP_NONET_RAW to install the malformed rule.
• Impact: every packet matching the rule triggers the OOB. Most likely: rnh->rnh_lookup dereferences a garbage pointer → kernel panic → reliable DoS. If the adjacent heap contains a valid-looking structure, the lookup silently reads attacker-uncontrolled kernel memory and the match result leaks one bit of heap state per packet.

Recommended fix

Bounds-check cmd->arg1 against IPFW_TABLES_MAX:

if (cmd->arg1 >= IPFW_TABLES_MAX) {
    *cmd_ctl = IP_FW_CTL_NO;
    return;
}

Apply in both check_from_lookup and check_to_lookup.

References

• sys/net/ipfw3_basic/ip_fw3_basic.c:311-318 — check_from_lookup.
• sys/net/ipfw3_basic/ip_fw3_basic.c:404-411 — check_to_lookup.
• sys/net/ipfw3_basic/ip_fw3.c:950-969 — rule installer with no arg1 bounds validation.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).