DF-0702 — PoC evidence pack

See VERDICT.md for the full analysis (verdict, mechanism, fix, fix-validation). Reproduce: ./build.sh && ./run.sh. Machine-readable catalog: manifest.json.

DF-0702 — Mbuf UAF and double-free in centre_test and send_state (sosend consumes m, loop reuses it)

Same ipfw3_sync dead-code caveat as DF-0700 — see that VERDICT for the full unreachability proof. Summary: the bug is real at source level; both functions are unreachable because the sockopt dispatcher (ip_fw3_ctl_sync_ptr, ip_fw3.c:133) is never assigned, and the one live-looking pointer (ipfw_sync_send_state_prt, assigned in MOD_LOAD) is never called by anyone.

Verdict

NOT REPRODUCED — LATENT dead code. Real source bug (classic "sosend eats my mbuf" UAF + double-free); unreachable on this kernel. Fix is defense-in-depth.

The bug (source-level trace)

ip_fw3_ctl_sync_centre_test() (ip_fw3_sync.c:313-349)

m = m_getl(len, M_WAITOK, MT_DATA, M_PKTHDR, &nsize);   /* :330 — ONE mbuf built */
...
for (i = 0; i < fw3_sync_ctx.count; i++) {
    error = so_pru_sosend(fw3_sync_ctx.centre_socks[i],
            NULL, NULL, m, NULL, 0, td);                 /* :340 — passes SAME m */
    if (error) { ... return -1; }
}
m_free(m);                                                /* :347 — free again */

so_pru_sosend → sosendudp (sys/kern/uipc_socket.c:960-1060). On the success path sosendudp consumes the mbuf: it either hands top to the lower layer which frees it after TX, or — on the in-place goto release paths — m_freem(top) at uipc_socket.c:1058-1059. In all cases sosendudp sets top = NULL at :1053 to mark the transfer of ownership (/* sent or freed in lower layer */). So after iteration i=0, the caller's m is freed. Iteration i=1 passes the freed m to sosendudp → use-after-free read (and the lower layer dereferences/frees it again). After the loop, m_free(m) at :347 frees it a third time → double-free (slab INVARIANTS trip, or silent cross-type corruption on a noinv kernel).

ip_fw3_sync_send_state() (ip_fw3_sync.c:438-467)

Same shape, no trailing m_free:

m = m_getl(len, M_WAITOK, MT_DATA, M_PKTHDR, &nsize);   /* :446 */
...
for (i = 0; i < fw3_sync_ctx.count; i++) {
    error = so_pru_sosend(fw3_sync_ctx.centre_socks[i],
            NULL, NULL, m, NULL, 0, td);                 /* :459 — SAME m each iter */
    ...
}
return;                                                   /* :466 — no m_free */

Iteration i≥1 reuses the freed m → UAF (read + lower-layer deref/free). No double-free here (no trailing m_free), but the UAF is the same class.

Why the loop even runs (the count > 1 precondition)

Both loops are gated on fw3_sync_ctx.count, which is only ever set by ip_fw3_ctl_sync_centre_conf (the DF-0700/0701 function). So the UAF needs count ≥ 2, which needs centre_conf to have been called.

Why unreachable on this kernel

Two independent layers of dead code:

1. centre_test is a sockopt handler → only reachable through ip_fw3_ctl_sync_sockopt → only dispatched via ip_fw3_ctl_sync_ptr (ip_fw3.c:133), which is never assigned anywhere (grep-verified). Dead. And centre_conf (needed to set count) is dead for the same reason — so count stays at its BSS zero and the loop body never executes even if centre_test were reached.

2. send_state is assigned to ipfw_sync_send_state_prt in MOD_LOAD (ip_fw3_sync.c:474), so it looks live — but ipfw_sync_send_state_prt is never called anywhere in the tree (grep shows only the declaration at :85 and the assignment at :474; no call site). And even if it were called, count is 0 (needs dead centre_conf), so the loop is a no-op.

Plus the base-kernel ipfw3 stub returns ENOPROTOOPT until kldload ipfw3, and the modules aren't loaded by default. Empirically confirmed by ipfw3_sync_deadpath (run.log).

Fix (defense-in-depth)

Pass a per-iteration copy of the mbuf to so_pru_sosend (each sosend then owns+frees its own copy), and free the original exactly once after the loop. See fix.diff (both functions):

for (i = 0; i < fw3_sync_ctx.count; i++) {
    struct mbuf *mc = m_copym(m, 0, M_COPYALL, M_NOWAIT);   /* +DF-0702 */
    if (mc == NULL) { ...; m_free(m); return -1; }
    error = so_pru_sosend(fw3_sync_ctx.centre_socks[i],
            NULL, NULL, mc, NULL, 0, td);                   /* pass the copy */
    ...
}
m_free(m);   /* free the original once */

Fix validation

• fix.diff applies cleanly (both hunks).
• Compile-validated with DF-0701/0703, make -j6 nativekernel → rc=0.
• fix_status: not_testable — dead code; validated applies + compiles.

Files

Kernel references (confirmed)

• sys/net/ipfw3_basic/ip_fw3_sync.c:313-349 — centre_test (UAF + double-free)
• sys/net/ipfw3_basic/ip_fw3_sync.c:330 — single m_getl
• sys/net/ipfw3_basic/ip_fw3_sync.c:340-341 — so_pru_sosend(..., m, ...) in loop
• sys/net/ipfw3_basic/ip_fw3_sync.c:347 — m_free(m) after loop (double-free)
• sys/net/ipfw3_basic/ip_fw3_sync.c:438-467 — send_state (UAF, no double-free)
• sys/net/ipfw3_basic/ip_fw3_sync.c:446 — single m_getl
• sys/net/ipfw3_basic/ip_fw3_sync.c:459-460 — so_pru_sosend(..., m, ...) in loop
• sys/kern/uipc_socket.c:1044-1053 — sosendudp consumes top (top = NULL)
• sys/net/ipfw3/ip_fw3.c:133 — ip_fw3_ctl_sync_ptr = NULL (dead dispatcher)