DF-0732 — TOCTOU in wlan_acl acl_getioctl MACCMD_LIST

Verdict: REPRODUCED (heap OOB write + uninit-heap info leak); fix VALIDATED. Severity: High. CWE: CWE-787 (OOB write), CWE-908 (uninit memory).

The bug

sys/netproto/802_11/wlan_acl/ieee80211_acl.c:313 reads as->as_nacls WITHOUT ACL_LOCK (taken only at :328) to size the kmalloc(space, M_TEMP, M_INTWAIT) at :319 (no M_ZERO), then TAILQ_FOREACH (:329-332) writes every current list entry unbounded. A concurrent ADDMAC/DELMAC between :313 and :328 makes the list diverge from the buffer size: - Grow → OOB heap write of attacker-controlled MAC bytes past the buffer. - Shrink → uninitialized tail shipped to userland by copyout (info leak).

Reproduce (userspace deterministic harness — PRIMARY proof)

sh build.sh     # builds harness (BUGGY) + harness_fixed (FIXED)
sh run.sh       # BUGGY => both races CONFIRMED; FIXED => both NOT TRIGGERED

Reproduce (real-kernel object-level harness — needs root to kldload)

# build harness_mod.ko (in guest, as root):
cd /root/df0732 && make SYSDIR=/usr/src/sys KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
kldload wlan; kldload wlan_acl; sysctl debug.use_malloc_pattern=1
kldload ./harness_mod.ko          # exposes /dev/df0732 (0666)
# as unprivileged user:
cc -O2 -pthread -o trigger trigger.c    && ./trigger  200000 4   # unpatched => panic
cc -O2 -pthread -o leakcheck leakcheck.c && ./leakcheck 100000 4  # fixed => WEIRD_ADDR=0

Runtime reachability

The live ACL ioctl path needs a wlan(4) vap on a wifi radio — absent on this KVM guest (ifconfig -l = vtnet0 lo0). The bug is proven at the object/harness level (real acl_getioctl panic + leak) and via deterministic transcription. On a wifi host with a vap, a local user could race ADDMAC vs MACCMD_LIST.

Fix

fix.diff: move ACL_LOCK before the as_nacls read, add M_ZERO, bound the foreach. Validated: rebuilt wlan_acl.ko clean, reloaded, no panic + zero WEIRD_ADDR residue.

Files

• harness.c — deterministic userspace transcription (PRIMARY proof)
• harness_mod.c / Makefile — real-kernel object-level harness module
• trigger.c — userspace racer (grow panic / shrink leak)
• leakcheck.c — definitive WEIRD_ADDR residue classifier
• fix.diff — git-apply-able fix (lock-before-read + M_ZERO + bounded foreach)
• VERDICT.md — full narrative + line-by-line analysis + before/after
• *.log — full untrimmed build/run/panic/leak logs

DF-0732 — TOCTOU in wlan_acl acl_getioctl MACCMD_LIST

Verdict

REPRODUCED — heap OOB write (grow race) and uninitialized-heap info leak (shrink race), confirmed at two levels:

1. Deterministic userspace harness (harness.c) — transcribes acl_getioctl MACCMD_LIST verbatim with a controlled interleaving point between the unlocked as_nacls read and ACL_LOCK. Prints GROW RACE OOB WRITE CONFIRMED and SHRINK RACE UNINIT LEAK CONFIRMED.
2. Real-kernel object-level harness (harness_mod.ko + trigger.c / leakcheck.c) — exercises the actual acl_getioctl via a fake vap + /dev/df0732, racing iac_add/iac_flush kthreads against the LIST ioctl. Produces a real kernel panic acl_getioctl+0xd6 (grow-race OOB write faulting the page) and live shrink-race heap-residue leaks.

Fix VALIDATED (Phase 8): the fix.diff (lock-before-read + M_ZERO + bounded foreach) rebuilds wlan_acl.ko clean (-Werror) and eliminates both manifestations in the real kernel — no panic, zero WEIRD_ADDR residue.

Runtime reachability note (the realistic-threat caveat): the live 802.11 ACL ioctl path requires a wlan(4) vap on a parent wifi radio. This KVM audit guest has no wifi radio (ifconfig -l = vtnet0 lo0; no ath/iwm/iwn; wlan_acl is a loadable KLD, not in X86_64_GENERIC). So an unprivileged runtime trigger is impossible on this guest; the bug is proven at the object/harness level (real acl_getioctl panic + leak) and via deterministic transcription. On a wifi-equipped host with a vap, a local user could race SIOCS80211 ADDMAC vs SIOCG80211 MACCMD_LIST for OOB write / leak. This is the same harness-precedent class as DF-0393/0594/0616/0753/0754.

The bug — line-by-line (sys/netproto/802_11/wlan_acl/ieee80211_acl.c)

acl_getioctl handles IEEE80211_MACCMD_LIST (:312-340):

ACL_LOCK/ACL_UNLOCK are real lockmgr(&as->as_lock, LK_EXCLUSIVE) locks (ieee80211_dragonfly.h:606/619). acl_add (:199-215) and _acl_free (:150-159) both mutate as_nacls/as_list under ACL_LOCK. So between the unlocked read at :313 and the lock at :328, a concurrent ADDMAC/DELMAC can change the list out from under the lister.

Grow race → heap OOB write (CWE-787)

Thread A (lister) reads as_nacls = N at :313, allocates N*6 bytes at :319. Thread B (adder) inserts K MACs under the lock. Thread A takes the lock at :328 and TAILQ_FOREACH writes N+K entries into the N*6-byte buffer: ap[N..N+K-1] are written K*6 bytes past the end. The MAC bytes are attacker-controlled (SIOCS80211 ADDMAC takes the MAC from userland). Real-kernel proof: Fatal trap 12 ... supervisor write data, page not present ... Stopped at acl_getioctl+0xd6: movw %si,0x4(%rcx) — the OOB write faulted into an unmapped page.

Shrink race → uninitialized-heap info leak (CWE-908)

Thread A reads as_nacls = N, allocates N*6 bytes (no M_ZERO). Thread B (flusher) clears the list to N-K. Thread A locks, TAILQ_FOREACH writes only N-K entries; the tail K slots ap[N-K..N-1] are never written and hold uninitialized heap residue. copyout ships all N*6 bytes to userland. Real-kernel proof: [shrink-leak] ret_len=49152 entries=8192 ... bytes: 00 00 43 6f 70 79 ("..Copy" — kernel string residue), varying run-to-run.

Harness methodology

harness.c — deterministic userspace transcription (PRIMARY proof)

Faithfully transcribes acl_getioctl MACCMD_LIST with the data structures (struct aclstate, struct ieee80211req_maclist = 6 bytes __packed, ACL_LOCK = pthread mutex). A racer thread mutates the list at a controlled interleaving point between the unlocked as_nacls read and the lock. A poisoned allocator fills the slab + red-zone with 0xAA canary so OOB writes and uninit tails are observable. Builds in two modes: - cc -O2 -pthread -o harness harness.c — BUGGY transcription. - cc -O2 -pthread -DFIXED -o harness_fixed harness.c — FIXED transcription (lock-before-read + M_ZERO + bounded foreach).

Results (run.log): BUGGY → GROW RACE OOB WRITE CONFIRMED (24 OOB bytes for N=8,K=4) + SHRINK RACE UNINIT LEAK CONFIRMED (4 uninit tail slots). FIXED → both NOT TRIGGERED.

harness_mod.c + trigger.c / leakcheck.c — real-kernel object-level harness

harness_mod.ko (built against the running kernel) allocates a minimal fake ieee80211vap, attaches the real "mac" aclator (wlan_acl.ko), exposes /dev/df0732 (0666) whose ioctl calls acl->iac_getioctl(fake_vap, &ireq), and runs adder + flusher kthreads that race the LIST path. The unprivileged trigger/leakcheck drive it. This exercises the actual vulnerable kernel function. kldload here loads the test harness, not an exploit — it is primitive characterization of an otherwise-runtime-unreachable path (the DF-0594/0616 object-harness precedent), not an escalation chain.

Results (panic.txt, leak_sample.txt, trigger_run.log): grow race → acl_getioctl+0xd6 panic (OOB write); shrink race → live heap-residue leak (kernel string "..Copy", varying bytes).

Exploit chain / impact ceiling

Primitive: attacker-controlled 6-byte heap writes into the slab object(s) adjacent to the ap buffer (grow race); 6-byte uninit heap reads per shrunk entry (shrink race). The ap buffer is kmalloc(N*6, M_TEMP); for typical N this lands in kmalloc-128/256/512. Attacker controls N (list size) and the MAC bytes written. On a noinv kernel this is a classic slab-groom → corrupt-adjacent → escalate candidate (forge ucred/ops vector with no SMAP/SMEP/KASLR on this guest). On default GENERIC, INVARIANTS slab checks (WEIRD_ADDR poisoning, chunk_mark_allocated) catch the cross-slab corruption and panic — confirmed by the real-kernel acl_getioctl+0xd6 trap.

Valid hard blocker (why no uid=0 here): the vulnerable runtime path (SIOCG80211 MACCMD_LIST on a wlan vap) requires a wifi radio driver, which is absent on this KVM guest. The primitive is therefore characterized at the harness/object level (real acl_getioctl panic + leak, deterministic transcription), not driven to a live unprivileged uid=0. On a wifi-equipped host with a vap, this is a local-root candidate via slab grooming of the OOB write; on this guest it is a confirmed DoS-panic + info leak.

Fix (fix.diff)

Three changes to acl_getioctl MACCMD_LIST, all targeting the root cause:

1. Move ACL_LOCK(as) BEFORE the as_nacls read (:313) so the size used for kmalloc and the list iterated by TAILQ_FOREACH cannot diverge. Add ACL_UNLOCK on the early-return and ENOMEM paths. ACL_LOCK is a sleepable lockmgr lock, so holding it across kmalloc(M_INTWAIT) is safe.
2. Add M_ZERO to the kmalloc (:319) (M_INTWAIT | M_ZERO) — kills the uninit-leak even if a future divergence reappears.
3. Bound the TAILQ_FOREACH write loop to space/IEEE80211_ADDR_LEN entries (if (i >= bound) break;) — defense-in-depth so the loop can never write past the buffer.

git apply --check passes. The FreeBSD branch (#else) is given IEEE80211_M_ZERO too for consistency.

Phase 8 — fix validation

Before (unpatched #0 baseline, prebuilt /boot/kernel/wlan_acl.ko): - grow race → Fatal trap 12 ... acl_getioctl+0xd6: movw %si,0x4(%rcx) (panic, guest down). (panic.txt) - shrink race → [shrink-leak] ret_len=49152 ... bytes: 00 00 43 6f 70 79 (kernel string residue leaked). (leak_sample.txt, trigger_run.log)

After (rebuilt wlan_acl.ko from patched source, sha256 c23e324c..., -Werror clean): - grow race → no panic; 241489 LIST ioctls completed, guest stayed UP. (fix_trigger_run.log) - shrink race → leakcheck: WEIRD_ADDR residue = 0, OTHER = 0 (no heap residue leaked). (fix_run.log) - Deterministic harness FIXED build → both races NOT TRIGGERED. (run.log, fix_run.log)

fix_status: fixed. The fix closes both the OOB write and the info leak in the real kernel and in the deterministic transcription.

PoC changes from the seeded version

The folder arrived with a prior runner's harness_mod.c / trigger.c / Makefile (object-level harness) and their captured panic.txt / leak_sample.txt. This run: - Re-verified the real-kernel panic (acl_getioctl+0xd6) and shrink-race leak against the unpatched prebuilt module (refreshed panic.txt, leak_sample.txt, new trigger_run.log). - Added harness.c — a clean deterministic userspace transcription with a poisoned allocator and grow/shrink modes (the PRIMARY proof per the task framing). - Added leakcheck.c — a definitive residue classifier that distinguishes real WEIRD_ADDR (0xdeadc0de) heap residue from valid adder MACs, removing the false positives in the original trigger.c's is_known_mac() (which assumed adder byte3 always == 0xef). - Authored fix.diff (lock-before-read + M_ZERO + bounded foreach) and validated it end-to-end: git apply --check, rebuild wlan_acl.ko (-Werror), reload, re-run trigger/leakcheck → no panic, zero residue. - Added build.sh / run.sh repro scripts, refreshed build.log / run.log, fix_build.log / fix_run.log / fix_trigger_run.log, env.txt.

Reproduce

# userspace deterministic harness (PRIMARY proof; no root, no wifi needed)
cd findings/poc/DF-0732 && sh build.sh && sh run.sh
# BUGGY: GROW RACE OOB WRITE CONFIRMED + SHRINK RACE UNINIT LEAK CONFIRMED
# FIXED: both NOT TRIGGERED

# real-kernel object-level harness (needs root to kldload the harness module)
# kldload wlan; kldload wlan_acl; kldload ./harness_mod.ko
# sysctl debug.use_malloc_pattern=1
# ./trigger 200000 4   # unpatched wlan_acl => panic (acl_getioctl+0xd6)
# ./leakcheck 100000 4 # fixed wlan_acl    => WEIRD_ADDR residue = 0