DF-0687 — SCO sco_ctloutput PRCO_GETOPT missing-break NULL-deref panic

Verdict

REPRODUCED on baseline 6.5-DEVELOPMENT #0 (build Thu Jul 2 06:02:54 UTC 2026). FIXED on single-fix-combined kernel 6.5-DEVELOPMENT #1 (build Sun Jul 19 06:56:50 UTC 2026, sha256 32765f70…).

Mechanism (trigger → primitive → effect)

sys/netbt/sco_socket.c:109-121 sco_ctloutput case PRCO_GETOPT:

m = m_get(M_WAITOK, MT_DATA);                                       // :111
m->m_len = sco_getopt(pcb, sopt->sopt_name, mtod(m, uint8_t *));    // :112
if (m->m_len == 0) {                          // unknown opt OR unconnected
    m_freem(m); m = NULL; err = ENOPROTOOPT;  // :113-117
}                                              // *** MISSING break ***
/* *opt = m; */
/* XXX There are possible memory leaks (Griffin) */                   // :119
sopt_from_kbuf(sopt, mtod(m, void *), m->m_len);                     // :120 mtod(NULL) deref

Mechanically identical to DF-0680 (RFCOMM) and DF-0682 (L2CAP). sco_getopt (sys/netbt/sco_upper.c / sco_socket.c:354-357) returns 0 in two cases: (a) unknown option name (the default: case), and (b) SO_SCO_HANDLE=2 when the socket is unconnected (sp_link == NULL). In both cases m_len == 0, the block runs m_freem(m); m=NULL; err=ENOPROTOOPT;, and falls through to sopt_from_kbuf(sopt, mtod(m, void *), m->m_len) with m==NULL → page fault at offsetof(struct mbuf, m_data) == 0x18 → panic.

The maintainer flagged this code path years ago — the comment at line 119 /* XXX There are possible memory leaks (Griffin) */ — but the more serious bug (the NULL deref) was missed.

sco_sattach performs no privilege check, so any unprivileged local user can create the socket. Precondition: netbt.ko loaded.

Triggers

socket(AF_BLUETOOTH=33, SOCK_SEQPACKET, BTPROTO_SCO=4)
getsockopt(fd, BTPROTO_SCO, 0xFFFF /* unknown */, &buf, &len)
        OR
getsockopt(fd, BTPROTO_SCO, SO_SCO_HANDLE=2, &buf, &len)   /* unconnected */

→ deterministic kernel panic, 100 % reliable, no Bluetooth hardware needed.

Panic signature (baseline)

Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x18
fault code               = supervisor read data, page not present
Stopped at      sco_ctloutput.cold.2+0x8:       movl    0x18,%eax
db>

0x18 = offsetof(struct mbuf, m_data) — the NULL+offset deref from mtod(NULL).

Realistic impact ceiling

Deterministic local kernel panic / DoS. NULL-page read fault (no write), so no memory-corruption primitive and no escalation chain.

Fix

sys/netbt/sco_socket.c: add break; after the ENOPROTOOPT block, and m_freem(m) the buffer on the success path. The maintainer's XXX … memory leaks (Griffin) comment is resolved by the success-path free (we removed the now-stale comment).

See fix.diff (git-apply-able).

Fix validation (Phase 8)

• Baseline (with-src #0): ./trigger ⇒ Fatal trap 12 at sco_ctloutput.cold.2+0x8: movl 0x18,%eax ⇒ guest DOWN (DDB).
• Patched (#1): ./trigger ⇒ getsockopt returned -1 (errno=42 Protocol not available) (ENOPROTOOPT from the fixed path), guest UP.

Clean before/after. Fix closes the bug.