β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0699

Wrong byte counter after BPF truncation: totlen -= len should be totlen = len

Summary

ng_bpf_rcvdata (:414-418): if(len<totlen){m_adj(m,-(totlen-len));totlen-=len;} m_adj trims (totlen-len) bytes so pkthdr.len==len correct. But totlen-=len makes totlen=(orig-len) = bytes stripped not new length. Corrupted totlen consumed as xmitOctets delta :429 dhip->stats.xmitOctets+=totlen. 1500B packet filter returns 30 -> xmitOctets+=1470 instead of 30. Forwarded packet correct only accounting wrong. netgraph7 fixed :486 (totlen=len) legacy never updated. No security impact totlen consumed only as u_int added to u_int64_t stat no length-driven copy. Fix: totlen=len.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0699 Β· 1 files
FileTypeDescriptionSize
fix.diff suggested-fix Wrong byte counter after BPF truncation: totlen -= len should be totlen = len 352 B view raw

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

fix.diff applied + combined nativekernel build rc=0 (-Werror)

fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/netgraph/bpf/ng_bpf.c:414: wrong byte counter after BPF truncation (totlen-=len should be totlen=len)

Verified recommended fix

Source-confirmed at sys/netgraph/bpf/ng_bpf.c:414: wrong byte counter after BPF truncation (totlen-=len should be totlen=len)

Verdict

Source-confirmed at sys/netgraph/bpf/ng_bpf.c:414: wrong byte counter after BPF truncation (totlen-=len should be totlen=len)