β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0681

Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports bogus flow-control credits

Summary

rfcomm_getopt SO_RFCOMM_FC_INFO (rfcomm_upper.c:550-551): fc->tx_cred=max(dlc->rd_txcred,0xff) fc->rx_cred=max(dlc->rd_rxcred,0xff). max() should be min() for downward clamp to uint8_t. max(x,255) returns 255 when x<255 (common: rd_txcred default RFCOMM_CREDITS_DEFAULT=7 -> reported 255 not 7) returns raw x when x>=255 then truncated. Pure data correctness wrong value to userspace no mem-safety impact. Kernel flow control uses rd_txcred/rd_rxcred directly unaffected. Fix: min(dlc->rd_txcred,0xff).

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0681 Β· 1 files
FileTypeDescriptionSize
fix.diff suggested-fix Incorrect clamp (max instead of min) in rfcomm_getopt SO_RFCOMM_FC_INFO reports 502 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/netbt/rfcomm_upper.c:550: incorrect clamp (max instead of min) reports bogus flow-control credits

Verified recommended fix

Source-confirmed at sys/netbt/rfcomm_upper.c:550: incorrect clamp (max instead of min) reports bogus flow-control credits

Verdict

Source-confirmed at sys/netbt/rfcomm_upper.c:550: incorrect clamp (max instead of min) reports bogus flow-control credits