bootpc trusts interface sdl_alen without bounding it to chaddr[16]/hexstr[64] — over-long link address from an IFT_ETHER driver overflows the outgoing packet in-struct and smashes a 64-byte stack buffer via hexncpy

Summary

bootpc_fakeup_interface selects any link address whose sdl_type == IFT_ETHER but never validates sdl_alen. The value is then used as a copy length into fixed buffers: (a) bcopy(LLADDR(sdl), &call.chaddr, sdl_alen) — chaddr is 16 bytes inside struct bootp_packet, so sdl_alen>16 overruns into sname/file/vend of the client's own outgoing query; (b) call.hlen = sdl_alen makes the reply matcher bcmp() chaddr beyond 16 bytes (in-struct overread); (c) hexncpy passes a 64-byte stack buffer with outlen = alen*3 computed from the same untrusted length — libkern hexncpy trusts that outlen, so sdl_alen>=22 writes up to 765 bytes past hexstr[64]: a boot-time stack overflow. All Ethernet drivers set sdl_alen=6 via ether_ifattach, so exploitation requires a driver claiming IFT_ETHER with an over-long address (broken or virtual/future driver) — hardware-gated, boot-stage only, hence speculative/Low; flagged because the boot path performs no defense-in-depth check. Not testable on the audit guest (netboot-only + synthetic driver). Fix: clamp the HW address length once at interface selection + pass sizeof(hexstr) to hexncpy (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of bootp_subr.c (GLM 5.3).