DF-2253 — sep==NULL misplaces NUL terminator and truncates output

sys/libkern/hexncpy.c lines 56-62 (Low, memcorrupt bucket / correctness). VERIFY run 2026-10-17.

What was verified and how

Same kernel-compiled harness as DF-2252 (harness_hexncpy.c appended to the guest's /usr/src/sys/libkern/hexncpy.c, make nativekernel, sysctl-driven): cases C4/C5/C6 exercise sep == NULL through the REAL production function.

• C5 — the cited reachable instance, exact call shape of sys/netinet/if_ether.c:643 (hexncpy((unsigned char *)&ar->ar_hrd, 2, hexstr, 5, NULL) from arpintr()): input bytes 12 34 (ar_hrd 0x1234) -> stock kernel returns the string "1" — the loop wrote '1','2' then stopped (outlen drains 3 per iteration: 5 -> 2 < 3), and *--outb = 0 (hexncpy.c:62) backed over the '2'. One hex digit instead of four; the low nibble of the first byte is silently dropped.
• C4 — generic truncation: inlen=6, outlen=HEX_NCPYLEN(6)=18, sep=NULL -> "deadbeef123" (11 digits, the 12th clobbered): the drain-3 accounting converts only ceil-ish 2/3 of the buffer when no separator is written.
• C6 — mly.c:1344 shape: inlen=4, outlen=12, sep=NULL -> "deadbee" instead of "deadbeef".

End-to-end on the live stock kernel (kernel #1, INVARIANTS)

arp_inject.c writes a crafted ethernet frame (ar_hrd = 0x1234) to /dev/tap0; tapwrite() injects it into ifp->if_input = ether_input() (sys/net/tap/if_tap.c:981) -> NETISR_ARP -> arpintr() (sys/netinet/if_ether.c:630-648) -> the line-643 hexncpy -> console:

arp_inject: wrote 42 bytes to /dev/tap0 (ar_hrd=0x1234)
arp: unknown hardware address format (0x1)      <- stock: ONE digit, should be (0x1234)

(arp_e2e.log.) The injector needs root only because /dev/tap0 is root-only on the guest — on a real network, any LAN peer can send such a frame unauthenticated; the impact is a wrong one-digit diagnostic in the log (cosmetic/correctness, no memory unsafety: hexstr is char[6] and the write stays at hexstr[1]).

Fix validation (A/B, kernel #2 with fix.diff)

• C5 -> "1234", C4 -> "deadbeef1234", C6 -> "deadbeef": sep==NULL now drains 2 per iteration and terminates right after the last digit.
• sep!="" control C1 -> de-ad-be-ef, bit-identical to stock.
• End-to-end re-run: arp: unknown hardware address format (0x1234) — full four digits (arp_e2e_fixed.log).

Reproduce

# guest up with /usr/src (vm.sh reset with-src)
sh build.sh      # harness (+ pseudo-device tap) into kernel, nativekernel, reboot
sh run.sh        # matrix sysctl + tap create + arp_inject + dmesg check

DF-2253 — VERDICT

Status: reproduced — impact: none beyond a wrong diagnostic (this is a correctness bug in a print helper, not memory unsafety; every write stays inside the caller's buffer). All three claim elements verified through the REAL kernel function, plus the unauthenticated-packet end-to-end on the live stock kernel. Fix validated A/B.

Root cause (path:line)

• sys/libkern/hexncpy.c:56 — outlen -= 3 unconditionally, but the separator write at :59-60 is conditional on sep != NULL.
• sys/libkern/hexncpy.c:62 — *--outb = 0 backs the pointer over the last written char regardless of what that char was.

Combined effect when sep == NULL:

1. Truncation: budget drains 3/iteration while only 2 chars are written — a HEX_NCPYLEN(n)-sized buffer converts at most ~2n/3 bytes... (exactly: floor((outlen)/3) iterations = n for a paired buffer, but for buffers sized as 3n the loop stops one iteration early relative to what 2-char groups would allow) and the output is silently shorter than the input hex.
2. Misplaced terminator: the NUL overwrites the low-nibble digit of the last converted byte.

Verified case matrix (kernel-compiled harness, kernel #1, stock code)

Reachable instance, end to end on the live stock kernel

sys/netinet/if_ether.c:630-648 arpintr(): any ARP frame whose ar_hrd is neither ARPHRD_ETHER nor ARPHRD_IEEE802 logs "arp: unknown hardware address format (0x%s)" with the value produced by hexncpy((unsigned char *)&ar->ar_hrd, 2, hexstr, 5, NULL) (:643).

Demonstration (arp_inject.c + tap(4)): writing a crafted 42-byte ethernet frame with ar_hrd = 0x1234 to /dev/tap0 lands directly in ifp->if_input (sys/net/tap/if_tap.c:981) → ether_input() → NETISR_ARP → arpintr() → the :643 call. Stock kernel console:

arp_inject: wrote 42 bytes to /dev/tap0 (ar_hrd=0x1234)
arp: unknown hardware address format (0x1)

One hex digit instead of four (arp_e2e.log; reproduced twice, two identical lines). The injector needs root only because /dev/tap0 is root-only on the guest; on a real network an unauthenticated LAN peer triggers the same path with a single frame — hence the finding's threat model. Memory safety: hexstr is char hexstr[6] on arpintr's stack (if_ether.c:632); the function writes at most hexstr[0..1] here — no overflow, purely a wrong diagnostic value (operators see 0x1 for any 0x10?? hrd, and 0x0 for any 0x00?? — the top nibble only).

Fix validation (A/B, kernel #2 with fix.diff)

Same harness + same tap injection on the patched kernel (fix_run.log, arp_e2e_fixed.log):

fix.diff changes the drain to sep ? 3 : 2 and terminates right after the last digit for sep == NULL (and after the trailing separator, as historically, for sep != NULL); the loop still honors outlen >= 3 before each group, so the NUL always lands at index <= outlen-1 — the fix cannot overflow any HEX_NCPYLEN-paired buffer (checked for if_ether's hexstr[6] and mly's outlen=12 call).

Artifacts

run.log (baseline matrix), arp_e2e.log / arp_e2e_fixed.log (packet end-to-end A/B), fix_run.log (patched matrix), build.log / fix_build.log, arp_inject.c (sha256 18d55cc12e5cb93fc7439c11acc73eaeb5ed4852eb07c230935e1555e2d1d98d), harness_hexncpy.c, fix.diff (shared with DF-2252, git-apply clean), env.txt, run.sh.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.