DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2596

Incorrect totlen update after packet truncation produces wrong xmitOctets statistics

Summary

When BPF filter returns snaplen(len) less than packet length code truncates mbuf via m_adj correctly but updates totlen with totlen-=len instead of totlen=len. FreeBSD upstream uses totlen=len. Result dhip->stats.xmitOctets records (orig_totlen-len) instead of actual forwarded length (len). No memory-safety only incorrect statistics accounting.

Discussion (0)

No comments yet.