DF-0720

Heap overflow: if_alloc(IFT_PPP) returns sizeof(struct ifnet) but sppp_attach writes ~1KB of struct sppp fields past allocation (LATENT — file does not compile)

Summary

LATENT — file does not compile (IFP2SP/SP2IFP undefined see DF-0721). ng_sppp.c:249 if_alloc(IFT_PPP) returns sizeof(struct ifnet) only (if.c:3083-3084 only IFT_ETHER gets sizeof(arpcom)). :254 pp=IFP2SP(ifp) casts to struct sppp*. :285 sppp_attach(ifp) casts to struct sppp* and writes pp_next pp_fastq pp_cpq pp_seq[5] pp_rseq[5] state[5] timeout[5] lcp ipcp ipv6cp myauth hisauth ~1KB past allocation. Deterministic heap corruption on node creation IF file compiled. Trigger: ngctl mkpeer sppp (root netgraph socket). Fix: kmalloc(sizeof(struct sppp)) not if_alloc(IFT_PPP).

Discussion (0)

No comments yet.

Severity: High
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U:C:H/I:H/A:H
CWE: CWE-787 Out-of-bounds Write
File: sys/netgraph7/ng_sppp.c
Lines: 249-285
Area: net
Discovered: 2026-07-03
Updated: 2026-07-03

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-07-17 02:56:53
Attempts: —
Runtime: —
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-07-17 02:56:53
Runtime: —
Kernel: n/a
fix.diff: findings/poc/DF-0720/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-0720 · 8 files

File	Type	Description	Size
ng_sppp_harness.c	trigger-source	structural model of the if_alloc/sppp_attach size mismatch	2.6 KB	view raw
build.sh	build-script	cc -O2 -Wall	120 B	view raw
run.sh	run-script	runs structural model	96 B	view raw
run.log	run-log	1024 bytes written past the ifnet-sized allocation	370 B	view raw
fix.diff	suggested-fix	allocate sizeof(struct sppp); define IFP2SP/SP2IFP; fix include	1.9 KB	view raw
env.txt	environment	IFP2SP undefined in sys/; no ng_sppp module	432 B	view raw
../fix_build_combined.log	build-log	Combined 41-finding kernel build (rc=0, -Werror clean)	5.6 MB	↓ download
../fix_build_summary.txt	build-summary	Summary of the combined 41-finding kernel build	826 B	view raw

Fix verification

not_testable

compile+harness validated

see evidence pack

↓ fix.diffn/a

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

—

Verdict

LATENT/dead code. ng_sppp.c doesn't compile (IFP2SP undefined). Structural overflow real: if_alloc returns sizeof(ifnet) but sppp_attach writes sizeof(sppp).