DF-0666 — PoC evidence pack

Summary

• File: sys/netgraph/ng_device.c:589-591
• Claim: m = m_devget(buffer, len, 0, NULL) with no NULL check; NG_SEND_DATA_ONLY(error, hook, m) then derefs the possibly-NULL m. write(fd, buf, 0) ⇒ len==0 ⇒ m_devget returns NULL ⇒ instant panic.

Verdict

NOT REPRODUCED on this kernel — cited file is dead code (not in sys/conf/files). The active sys/netgraph7/ng_device.c:460-467 explicitly guards uio_resid==0 and NULL-checks the mbuf allocation. See VERDICT.md.

How to "reproduce" (the source-level analysis only)

No build or run is needed: the cited file is not compiled. run.sh re-prints the dead-code evidence.

Environment

See env.txt.

Fix

fix.diff deletes the dead sys/netgraph/ng_device.c (same as DF-0664/DF-0663). The netgraph7 rewrite already has the missing NULL check and len==0 gate, so patching the dead file buys nothing.

DF-0666 — VERDICT

Verdict: NOT REPRODUCED on this kernel — cited file is DEAD CODE (not built)

The m_devget NULL-deref claim against sys/netgraph/ng_device.c:589-591 is real at the source level:

589:    m = m_devget(buffer, len, 0, NULL);
590:
591:    NG_SEND_DATA_ONLY(error, connection->active_hook, m);

There is no NULL check on m after m_devget. If len == 0, m_devget's while (len > 0) loop never executes and it returns the initial NULL mfirst. NG_SEND_DATA_ONLY then derefs m->m_flags (CHECK_DATA_MBUF macro) → INVARIANTS panic, or in a non-INVARIANTS build a NULL deref in ng_send_data itself.

The len value at :563 is int len = uio->uio_resid; — a size_t→int truncation that can wrap a huge uio_resid to a negative int, although the surrounding :583 if (len > 0) gate prevents the negative case from reaching m_devget.

However, the cited file is not built by any standard kernel or module (verified identical to DF-0663/DF-0664):

$ grep "ng_device" sys/conf/files
netgraph7/ng_device.c       optional netgraph7_device

Only sys/netgraph7/ng_device.c is built. Its ngdwrite (sys/netgraph7/ng_device.c:452-472) is a complete rewrite that explicitly guards against exactly this bug:

460:    if (uio->uio_resid == 0)
461:        return (0);                       /* <-- gates len==0 */
...
466:    if ((m = m_uiotombuf(uio, M_NOWAIT, 0, 0, M_PKTHDR)) == NULL)
467:        return (ENOBUFS);                 /* <-- NULL check */

The rewritten version uses m_uiotombuf (not m_devget) and has both the len==0 early return and the NULL check that the dead original lacks.

Why the live kernel cannot trigger this

Verified on the running guest (#0 build): - nm /boot/kernel/kernel | grep -E "ngdwrite" → no matches - ls /boot/kernel/ | grep ng_device → no module file exists - kldstat → no ng_device module loaded

The OLD sys/netgraph/ng_device.c is dead code retained for historical reference; netgraph7 superseded it. Same situation as DF-0663 and DF-0664.

Recommended fix

Delete the dead file (preferred). The bundled fix.diff deletes sys/netgraph/ng_device.c. This supersedes the finding's source proposal (add NULL check + len gate) — the netgraph7 rewrite already has both, so patching the dead file buys nothing.