β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0678

Missing NULL-node guard in ng_gif_input/ng_gif_input_orphan (latent panic; unreachable while file is dead code)

Summary

DEAD CODE: file cannot compile (IFP2NG/IFP2NG_SET access gif_softc.gif_netgraph field that doesnt exist in struct gif_softc if_gif.h:50-63; ng_gif_mod_event references ng_gif_*_p hooks never declared/defined; sys/conf/files:1706 gates behind options netgraph7_gif enabled by no kernel config). ng_gif_input :170-173 and ng_gif_input_orphan :190-191 dereference NG_NODE_PRIVATE(IFP2NG(ifp)) with no NULL guard. ng_gif_detach :272 correctly guards if(node==NULL)return but input hooks dont. If gif interface has no attached ng_gif node (common case) NULL-deref panic. Doubly unreachable: file doesnt build + if_gif.c never calls these _p hooks. Info/speculative: real crash bug if build revived. Fix: add if(node==NULL) return/m_freem guard.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0678 Β· 1 files
FileTypeDescriptionSize
manifest.json file 392 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/netgraph7/ng_gif.c:170: missing NULL-node guard (latent panic; file is dead code)

Verified recommended fix

Source-confirmed at sys/netgraph7/ng_gif.c:170: missing NULL-node guard (latent panic; file is dead code)

Verdict

Source-confirmed at sys/netgraph7/ng_gif.c:170: missing NULL-node guard (latent panic; file is dead code)