DF-0680 — RFCOMM rfcomm_ctloutput PRCO_GETOPT missing-break NULL-deref panic

Verdict

REPRODUCED on baseline 6.5-DEVELOPMENT #0 (build Thu Jul 2 06:02:54 UTC 2026). FIXED on single-fix-combined kernel 6.5-DEVELOPMENT #1 (build Sun Jul 19 06:56:50 UTC 2026, sha256 32765f70…).

Mechanism (trigger → primitive → effect)

sys/netbt/rfcomm_socket.c:115-127 rfcomm_ctloutput case PRCO_GETOPT:

m = m_get(M_WAITOK, MT_DATA);                 // :117  m != NULL
crit_enter();
m->m_len = rfcomm_getopt(pcb, sopt->sopt_name, mtod(m, void *)); // :119
crit_exit();
if (m->m_len == 0) {                          // :121  unknown opt -> 0
    m_freem(m);                                // :122
    m = NULL;                                  // :123
    error = ENOPROTOOPT;                       // :124
}                                              // *** MISSING break ***
sopt_from_kbuf(sopt, mtod(m, void *), m->m_len); // :126  mtod(NULL) deref

rfcomm_getopt (sys/netbt/rfcomm_upper.c:540-566) returns 0 for any option name other than SO_RFCOMM_MTU=1 / SO_RFCOMM_FC_INFO=2 / SO_RFCOMM_LM=3. With m_len == 0, the code frees m, sets m = NULL, sets error = ENOPROTOOPT, and falls through to sopt_from_kbuf(sopt, mtod(m, void *), m->m_len). mtod(m, void *) is ((struct mbuf *)m)->m_data; with m == NULL this reads at offset offsetof(struct mbuf, m_data) == 0x18 of the NULL page → kernel page fault → panic.

rfcomm_sattach (sys/netbt/rfcomm_socket.c:302-329) performs no privilege check (priv_check/suser), so any unprivileged local user can create the socket. The only precondition is netbt.ko loaded (realistic on Bluetooth- enabled systems).

Trigger

socket(AF_BLUETOOTH=33, SOCK_STREAM, BTPROTO_RFCOMM=3)
getsockopt(fd, BTPROTO_RFCOMM, 99 /* unknown */, &buf, &len)
                            ^^^^^^^^^^^^^^^^^^ any value other than 1/2/3

→ deterministic kernel panic, 100 % reliable, no Bluetooth hardware needed.

Panic signature (baseline)

Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x18
fault code               = supervisor read data, page not present
Stopped at      rfcomm_ctloutput.cold.9+0x8:    movl    0x18,%eax
db>

0x18 is exactly offsetof(struct mbuf, m_data) — the NULL+offset dereference from mtod(NULL).

Realistic impact ceiling

This is a deterministic local kernel panic / DoS. The fault is a read of the NULL page (not a write), so there is no memory-corruption primitive — no escalation chain is possible. Once netbt.ko is loaded, any local user can panic the machine instantly and repeatedly.

Precondition: netbt.ko loaded (root action; realistic on Bluetooth-enabled systems). No kldload by the attacker is required.

Fix

sys/netbt/rfcomm_socket.c: add break; after the ENOPROTOOPT block so the function returns the error instead of falling through into the sopt_from_kbuf(mtod(NULL)) deref. Also m_freem(m) the buffer on the success path (the original code transferred bytes into sopt but never freed m, leaking it — a real but minor leak).

See fix.diff (git-apply-able).

Fix validation (Phase 8)

• Baseline (with-src #0, unpatched): ./trigger ⇒ Fatal trap 12 at rfcomm_ctloutput.cold.9+0x8: movl 0x18,%eax ⇒ guest DOWN (DDB).
• Patched (#1, all 5 fixes incl. this one): ./trigger ⇒ getsockopt returned -1 (errno=42 Protocol not available) (i.e. ENOPROTOOPT, exactly what the fixed path returns), guest STAYS UP.

Clean before/after. Fix closes the bug.