do_setopt_accept_filter() saves the filter NAME as so_accept_filter_str instead of the user's af_arg — getsockopt(SO_ACCEPTFILTER) returns the name as the argument; latent divergence from FreeBSD (functional, dead in-tree)
| Field | Value |
|---|---|
| ID | DF-2978 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-628 |
| File | sys/kern/uipc_socket.c |
| Lines | 2043-2049 (found in uipc_accf.c pass-2 sweep) |
| Area | kern/net |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
do_setopt_accept_filter allocates strlen(afap->af_name)+1 and strcpy's afap->af_NAME into so_accept_filter_str, but the field is documented and consumed as the saved user ARGument: sogetopt copies it back into afap->af_arg and FreeBSD's version stores afap->af_arg. The block is guarded by accf_create != NULL, and both in-tree filters set accf_create/destroy to NULL, so the bug is dead code in-tree — but any kld defining accf_create gets its per-socket argument string silently replaced by the filter name (breaks filter configuration round-tripping; the accf_create callback itself still receives the correct af_arg). No memory-safety impact. Fix: one-word change to af_arg (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of uipc_accf.c (GLM 5.3). DF-0248 re-verified still present, not re-reported.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2978 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 631 B | ↓ raw | |
| VERDICT.md | — | 1.0 KB | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 661 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 588 B | view raw |
DF-2978 — accept filter saves name instead of arg (Info-tier hardening verification)
What
accept filter saves name instead of arg
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
build.sh env.txt fix.diff run.sh sourcenote.txt
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2978 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation (dead code in-tree: both shipped accept filters - sys/net/accf_data/accf_data.c:55-59 and accf_http - set accf_create NULL, so the guarded block cannot execute without a third-party KLD defining accf_create, i.e. root): do_setopt_accept_filter allocates strlen(af_name)+1 and strcpy's afap->af_NAME into so_accept_filter_str (uipc_socket.c:2043-2049), but the field is consumed as the saved user ARGument - getsockopt(SO_ACCEPTFILTER) copies it back into afap->af_ARG (:2341-2342); FreeBSD stores af_arg. Any KLD with accf_create gets its per-socket argument silently replaced by the filter name (config round-trip breaks; accf_create itself still receives the correct af_arg at :2051). No memory-safety impact (name is NUL-terminated within 16 bytes and the allocation matches). Fix (save af_arg instead) compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableOne-word fix (af_name -> af_arg, strcpy -> strlcpy) compiled and booted.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: save/consume mismatch + in-tree accf_create==NULL verification; fix.diff
PoC changes
none (dead in-tree; KLD-gated)
Verified recommended fix
Save afap->af_arg (not af_name) into so_accept_filter_str
Verdict
Line-accurate confirmation (dead code in-tree: both shipped accept filters - sys/net/accf_data/accf_data.c:55-59 and accf_http - set accf_create NULL, so the guarded block cannot execute without a third-party KLD defining accf_create, i.e. root): do_setopt_accept_filter allocates strlen(af_name)+1 and strcpys afap->af_NAME into so_accept_filter_str (uipc_socket.c:2043-2049), but the field is consumed as the saved user ARGument - getsockopt(SO_ACCEPTFILTER) copies it back into afap->af_ARG (:2341-2342); FreeBSD stores af_arg. Any KLD with accf_create gets its per-socket argument silently replaced by the filter name (config round-trip breaks; accf_create itself still receives the correct af_arg at :2051). No memory-safety impact (name is NUL-terminated within 16 bytes and the allocation matches). Fix (save af_arg instead) compiled in the fix kernel.
No comments yet.