Summary

rip_input enforces inp_ip_minttl (the IP_MINTTL socket option used for GTSM/BGP hardening) only against the last matching PCB in the pcblist walk. All other matching PCBs receive a copy of the packet via m_copypacket with no TTL check, defeating the minimum-TTL protection whenever more than one raw socket matches the same protocol/address tuple.

Root cause

In rip_input (raw_ip.c:144-213) the loop is structured as:

LIST_FOREACH(inp, &ripcbinfo.pcblisthead, inp_list) {
    /* proto + addr match filters ... */
    if (last) {
        struct mbuf *n = m_copypacket(m, M_NOWAIT);   /* line 165 */
        if (n) {
            /* ... append n to last->so_rcv UNCONDITIONALLY ... */ /* line 172 */
        }
    }
    last = inp;
}
/* Check the minimum TTL for socket. */
if (last && ip->ip_ttl < last->inp_ip_minttl) {       /* line 189 — LAST ONLY */

The TTL gate at line 189 only inspects the final value of last. For every previous last (every matching PCB that is not the last in pcblist order), delivery at lines 164-185 happens with zero consideration of that PCB's inp_ip_minttl.

Threat model & preconditions

• Attacker: unauthenticated remote.
• Preconditions: two or more raw sockets bound to the same protocol on the target host, and the protected socket is not the last in pcblist traversal order.
• Impact: an attacker can defeat GTSM protections on raw-IP daemons, injecting spoofed packets from beyond the intended TTL hop count. Uncommon precondition limits practical impact.

Recommended fix

Move the TTL check into the in-loop delivery path so every matched PCB is gated:

--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -161,6 +161,12 @@
        if (last) {
            struct mbuf *n = m_copypacket(m, M_NOWAIT);

+           if (n && ip->ip_ttl < last->inp_ip_minttl) {
+               m_freem(n);
+               n = NULL;
+           }
            if (n) {

References

• sys/netinet/raw_ip.c:164-185 — the in-loop delivery with no TTL check.
• sys/netinet/raw_ip.c:189 — the post-loop TTL check that only applies to the last PCB.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).