Summary

ip_divert_in() adds hlen to ip_len at line 607 after ip_reass() returns, but ip_reass() already includes the header length in ip_len (ip_input.c:1307, with explicit comment "Note that ip_len includes the header length"). This is a stale adjustment from when ip_reass did not include the header. The result is a corrupted ip_len (too large by hlen, or wrapped via 16-bit truncation for near-max-size reassembled datagrams) delivered to the divert daemon.

Root cause

ip_divert.c:589 calls m = ip_reass(m). ip_reass() at ip_input.c:1307 sets ip->ip_len = htons(next + hlen) (with the comment "Note that ip_len includes the header length").

ip_input's own normal reassembly path (ip_input.c:858-864) trusts this and does NOT add hlen again.

But ip_divert_in:601-607 does:

607:    ip->ip_len = htons(ntohs(ip->ip_len) + hlen);   /* BUG: hlen added again */

For a max-size reassembled datagram (next=65535-hlen), the resulting ntohs(ip->ip_len)+hlen = 65535+hlen wraps via the u_short ip_len field.

Threat model

• Attacker: remote — sends fragmented IP packets to a host with an ipfw divert rule.
• Impact: the divert daemon sees inconsistent ip_len vs actual mbuf length. No kernel crash; metadata corruption only. For near-max-size reassembled datagrams, ip_len wraps to a tiny value.

Recommended fix

Remove the stale hlen addition; keep the checksum recompute (still needed because ip_reass modifies ip_len/ip_src/ip_dst/ip_off).

--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -598,13 +598,13 @@
     */
    hlen = IP_VHL_HL(ip->ip_vhl) << 2;

+   /*
+    * Recompute the IP header checksum before diverting the
+    * packet to userspace, since ip_reass() modifies ip_len,
+    * ip_src, ip_dst and ip_off.  ip_reass() already sets
+    * ip_len to include the header length (ip_input.c:1307),
+    * so do NOT add hlen again.
+    */
-   /*
-    * Restore original checksum before diverting
-    * packet
-    */
-   ip->ip_len = htons(ntohs(ip->ip_len) + hlen);
    ip->ip_sum = 0;

References

• sys/netinet/ip_divert.c:607 — the stale hlen addition.
• sys/netinet/ip_input.c:1305-1307 — ip_reass includes header in ip_len.
• sys/netinet/ip_input.c:858-864 — ip_input's own path does NOT re-add hlen.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).