Summary

DORMANT TEMPLATE: ng_sample.c NOT in sys/netgraph7/Makefile SUBDIR nor sys/conf/files ships in no kernel/module. ng_xxx_rcvdata (:328) NGI_GET_M(item,m) :337 detaches mbuf caller owns both. Debug-hook branch (NG_HOOK_PRIVATE NULL only for debug hook set :240) else :378 compares if(hook==xxxp->downstream_hook.hook) :380 always false for debug hook (stored xxxp->debughook :239 distinct from downstream) so NG_FREE_ITEM :381 NG_FREE_M :382 never execute fall through return 0 :385 both item+m leaked. Comment "Its the debug hook throw it away" confirms intent copy-paste logic error. Each packet to debug hook leaks one ng_item + one mbuf chain. Live only if developer copies template into compiled module. Attacker: netgraph data-plane access (root/ng_socket). Impact: unbounded kernel mem exhaustion local DoS no C/I. Fix: unconditional NG_FREE_ITEM+NG_FREE_M in else branch.

PoC verification

Evidence pack

findings/poc/DF-0690 · 4 files

File	Type	Description	Size
VERDICT.md	verdict	source-confirmation + fix	990 B	↓ raw
../_batch_low/fix_build.log	build-log	combined 80-fix kernel build (rc=0, -Werror)	5.6 MB	↓ download
../_batch_low/combined_all.patch	suggested-fix	all 80 fixes batched	20.0 KB	view raw
../_batch_low/env.txt	environment	guest uname + kern.version	247 B	view raw

VERDICT.md verdict source-confirmation + fix

↓ download raw

DF-0690 — Low-severity source-confirmation

Verdict: INCONCLUSIVE

Impact: none Confidence: likely

Kernel ref: netgraph7/ng_sample.c:328

Mechanism / why

DORMANT: ng_sample.c is a template NOT in netgraph7/Makefile SUBDIR nor sys/conf/files; ships in no kernel/module; ng_xxx_rcvdata frees item then deref. Dead template.

Recommended fix

No runtime fix (dead template); fix the template for correctness.

Phase 8 (combined build)

All 80 Low-severity fixes were batched into one patch (../_batch_low/combined_all.patch) and applied to the in-guest /usr/src. A single make -j6 nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with 0 errors under -Werror (../_batch_low/fix_build.log). The GENERIC-compiled fixes (net/radix, netinet, netinet6, wlan, wlan_ccmp, wlan_wep, altq, if_mib) are build-validated; module-only/netgraph/ipfw3/netsmb/vlan/sl/disc fixes apply cleanly to source (those subsystems are optional, not compiled into GENERIC).

Confirmed kernel references

Detail

Exploit chain

none (dead code; source-confirmed)

Evidence (decisive lines)

DF-0690 [INCONCLUSIVE] - netgraph7/ng_sample.c:328

PoC changes

no runtime fix (dead template) in findings/poc/DF-0690/

Verified recommended fix