DF-2597 — TCP-MD5 (TCP_SIGNATURE) signature option overruns 40-byte opt[] stack buffer

Verdict: NOT REPRODUCED — real source-level defect in DEAD, UNBUILDABLE code

The cited overflow (sys/netinet/tcp_output.c:779-800) is a genuine source defect — the 20-byte signature option (TCPOLEN_SIGNATURE=18 + NOP/EOL=2) is appended to the 40-byte u_char opt[TCP_MAXOLEN] stack buffer with no bound check, so any prior options (MSS+window-scale+SACK-permitted+timestamp on a SYN → optlen=24, or timestamp + SACK blocks in ESTABLISHED → optlen up to 40) push the signature write 4–20 bytes past the end of opt[], corrupting the adjacent stack frame (optlen, hdrlen, ipoptlen, saved registers).

But the code path is completely unreachable on every kernel buildable from current DragonFly master, for two compounding reasons:

(1) TCP_SIGNATURE is not in the default GENERIC kernel

options TCP_SIGNATURE is commented out in sys/conf/options:271 and is absent from sys/config/X86_64_GENERIC. The vulnerable block is wrapped in #ifdef TCP_SIGNATURE, and so is the only way to arm it from userspace — the case TCP_SIGNATURE_ENABLE: handler in sys/netinet/tcp_usrreq.c:1556. On the running audit-source kernel (6.5-DEVELOPMENT #0, INVARIANTS ON):

[*] setsockopt(TCP_SIGNATURE_ENABLE) -> -1 errno=42 (Protocol not available)

setsockopt falls through to default: error = ENOPROTOOPT, TF_SIGNATURE can never be set, and tcp_output.c:779-800 is compiled out entirely. Runtime unreachable from any unprivileged (or even privileged) action on the default kernel. Verified: nm /boot/kernel/kernel | grep -ci tcpsignature = 0.

(2) TCP_SIGNATURE is UNBUILDABLE on current master — its dependency (IPsec SADB) was deleted

The TCP-MD5 feature (tcpsignature_compute in sys/netinet/tcp_subr.c:2199, and the digest-write call site at tcp_output.c:1058) depends on the KAME/IPsec SADB subsystem: key_allocsa(), struct secasvar, key_freesav(), key_sa_recordxfer(), _KEYBUF()/_KEYLEN(), and IPSEC_DIR_OUTBOUND. None of these exist anywhere in the current sys/ tree — the IPsec subsystem was removed (no sys/netproto/ipsec/, no key.h, no ipsec.h). Attempting to build a kernel with options TCP_SIGNATURE fails to compile:

/usr/src/sys/netinet/tcp_output.c:1058:37: error: 'IPSEC_DIR_OUTBOUND' undeclared

and even forcing past that, tcp_subr.c fails:

tcp_subr.c:2328:29: error: dereferencing pointer to incomplete type 'struct secasvar'
tcp_subr.c:2236:9: warning: implicit declaration of function 'key_allocsa'
tcp_subr.c:2331:2: warning: implicit declaration of function 'key_freesav'

So no kernel (default or custom) can be built from current master source with this code path live. The TCP_SIGNATURE code is orphaned dead code that references a subsystem that no longer exists in the OS.

Conclusion / classification

This is the valid hard blocker from Phase 6: the vulnerable code path is dead/unreachable at runtime AND no harness can exercise it — here elevated to the code cannot even be compiled into any kernel. The bug is a latent source-level defect (a missing optlen + TCPOLEN_SIGNATURE + 2 <= TCP_MAXOLEN bound check) that would be a real High-severity stack overflow if and only if the IPsec SADB subsystem were present and options TCP_SIGNATURE were enabled. On the audited kernel it has zero runtime impact.

Because there is no live memory-corruption primitive (the code never runs, never even links), there is no escalation chain to develop — Phase 6 escalation applies only to a live write primitive, which does not exist here.

Mechanism trace (source-confirmed, were the code reachable)

1. tcp_output() declares u_char opt[TCP_MAXOLEN] on its stack — TCP_MAXOLEN = 60 - sizeof(tcphdr) = 40 (sys/netinet/tcp.h:149, :148).
2. On a SYN with default sysctls (tcp_do_rfc1323=1 sets TF_REQ_SCALE|TF_REQ_TSTMP in tcp_subr.c:759; tcp_do_sack default) the option writers at tcp_output.c:719-766 produce: MSS(4)+window-scale(4)+SACK-permitted(4)+timestamp(12) = optlen=24 (TCPOLEN_MAXSEG=4 tcp.h:86, TCPOLEN_WINDOW=3 padded to 4, TCPOLEN_SACK_PERMITTED_ALIGNED=4 tcp.h:93, TCPOLEN_TSTAMP_APPA=12 tcp.h:101).
3. In ESTABLISHED with timestamp + 3 SACK blocks (tcp_sack_fill_report at tcp_sack.c:920 adds TCPOLEN_SACK_ALIGNED=4 + 3×TCPOLEN_SACK_BLOCK=8, bounded to ≤40), optlen reaches 40.
4. The signature block at tcp_output.c:779-800 then unconditionally writes TCPOPT_SIGNATURE+TCPOLEN_SIGNATURE (2) + 16 zero bytes + NOP+EOL (2) = 20 bytes at opt+optlen with no check, overrunning opt[] by 4 bytes (SYN) to 20 bytes (ESTABLISHED). The post-hoc KASSERT(optlen <= TCP_MAXOLEN) at :801 is a debug-only trip, not a guard.

Fix-validation status: not_testable

Phase 8 requires a clean before/after on a kernel that runs the vulnerable code. Here the vulnerable code cannot be compiled into any kernel (the IPsec dependency is gone), so there is no "before" baseline to reproduce against and no "after" patched kernel to test. fix.diff applies cleanly (git apply --check OK) and is a correct bound check, but it cannot be validated by building and booting, because the surrounding #ifdef TCP_SIGNATURE code does not compile on current master.

What fix.diff does (defense-in-depth for if IPsec/TCP-MD5 is reintroduced)

Wraps the signature-append block in a bound check: if ((tp->t_flags & TF_SIGNATURE) && optlen + TCPOLEN_SIGNATURE + 2 <= TCP_MAXOLEN). When there is no room, the signature is omitted (the segment fails MD5 verification on the peer — graceful degradation) rather than overrunning opt[]. Matches the spirit of the finding markdown's recommended fix; supersedes it with a precise, line-accurate guard.

Reproduce

cd findings/poc/DF-2597 && ./build.sh && ./run.sh
# Expected on the default audit-source kernel:
#   [*] setsockopt(TCP_SIGNATURE_ENABLE) -> -1 errno=42 (Protocol not available)
#   [!] RESULT: bug UNREACHABLE on this kernel (latent code defect).
#   RUN_EXIT=5