DF-3213 — stale RC_REPSTATUS survives dup-reply-cache slot reuse → rc_status/rc_reply union type confusion → kernel mbuf pointer material + wrong replies sent to an unauthenticated remote NFS client

File: sys/vfs/nfs/nfs_srvcache.c (pass 2)

What this is

The NFS server duplicate-reply cache (nfsrv_getcache / nfsrv_updatecache) reuses LRU slots when the cache is full. Slot reuse clears only RC_REPMBUF and RC_NAM:

    } else {
        rp = TAILQ_FIRST(&nfsrvlruhead);
        ...
        rp->rc_flag |= RC_LOCKED;
        LIST_REMOVE(rp, rc_hash);
        TAILQ_REMOVE(&nfsrvlruhead, rp, rc_lru);
        if (rp->rc_flag & RC_REPMBUF) {          /* nfs_srvcache.c:253 */
            m_freem(rp->rc_reply);
            ...
        }
        if (rp->rc_flag & RC_NAM) { ... }
    }

RC_REPSTATUS (set at nfs_srvcache.c:338) is never cleared anywhere in the tree (grep: the only clear sites for flags are REPMBUF/NAM). When the reused slot later stores a full reply mbuf via the v3 (or v2-non-repstat) branch (nfs_srvcache.c:340-347 — which also does not clear RC_REPSTATUS), the entry ends up with both RC_REPSTATUS|RC_REPMBUF set and the union rc_un/rc_haddr holding an mbuf *.

On a cache hit, nfsrv_getcache tests RC_REPSTATUS first (nfs_srvcache.c:212), so the retransmission is served by:

    nfs_rephead(0, nd, slp, rp->rc_status, repp, &mb, &bpos);

where rp->rc_status (int) aliases the low 32 bits of rp->rc_reply (struct mbuf *) — struct nfsrvcache unions them (nfsrvcache.h:54-65). nfs_rephead (nfs_socket.c:1614-1620) then either

• emits the raw value with only bit 30 masked to the wire (NFSERR_AUTHERR = 0x40000000, nfsproto.h:100 → MSG_DENIED / rpc_autherr / err & ~NFSERR_AUTHERR), when bit 30 of the pointer is set — a 31-bit kernel heap pointer disclosure, or
• clamps it through nfsrv_errmap (whitelist / NFSERR_IO default), producing a status-only reply that is not the cached reply at all — the duplicate reply cache answers retransmissions of non-idempotent NFS operations with a wrong, structurally different result.

Attacker: any UDP client that can reach the NFS server (no credentials, no filehandle, no export access needed — every request that parses creates a cache entry before authorization runs).

PoC

leakforger.c — raw RPC/UDP forger, run as unprivileged nobody from 127.0.0.1 against the in-guest kernel nfsd (UDP):

1. Phase A — M NFSv2 SYMLINK (wire proc 13 → generic 10) requests with distinct xids and an all-zero filehandle. v2 SYMLINK is nonidempotent and v2-repstat, so each reply is cached with RC_REPSTATUS, rc_status = 13 (EACCES; the phase-A reply shows status 0x0d).
2. Phase B — 2048 - M v2 NULL fillers fill desirednfsrvcache (= min(nmbclusters/2, 2048) = 2048 on this guest, nmbclusters=33296); the M stale entries become the LRU-oldest.
3. Phase C — M NFSv3 REMOVE (wire proc 12 → generic 12) requests with distinct xids; each MISS evicts one stale entry and reuses the slot (RC_REPSTATUS survives); the v3 completion stores the reply mbuf (RC_REPMBUF, rc_reply = m_copym(...)).
4. Phase D — retransmit each v3 REMOVE. The hit takes the RC_REPSTATUS branch and answers from rc_status = low-32 of the cached mbuf pointer.
5. Control — a fresh v3 REMOVE in a clean slot: its retransmit is byte-identical (legit RC_REPMBUF resend), proving the divergence above is the stale-flag bug and not normal behavior.

Build (in-guest)

sh build.sh        # pushes leakforger.c, cc -O2 -Wall

Run (in-guest, root starts nfsd; forger runs as nobody)

sh run.sh          # /sbin/nfsd -u -n 4 ; su -m nobody -c /tmp/leakforger 192 2048

Expected / observed (stock INVARIANTS kernel, DF 6.5-DEVELOPMENT)

• Phase-A replies: status 13 (0x0d) — EACCES for the zero filehandle.
• Phase-D retransmits: all 192/192 (and 192/192, 256/256 in repeats) diverge from the original reply: instead of the cached v3 error reply the server returns a 7-word status-only reply whose NFS status is 5 (NFSERR_IO) — the nfsrv_errmap default for a non-whitelisted value. This is the discrimination proof: the genuine stale status would have been 13, which is whitelisted for REMOVE and would have been returned unchanged; only a non-small value (the aliased rc_reply mbuf pointer low-32) clamps to 5. The reply to a retransmission of a non-idempotent operation is therefore (a) wrong and (b) derived from a kernel pointer.
• The raw 31-bit pointer escape (MSG_DENIED/auth_stat = ptr & 0xBFFFFFFF) requires bit 30 of the mbuf address to be set; across 640 poisoned slots on this guest the mbuf zone never had bit 30 set, so the raw value was always clamped. The mechanism is placement-dependent — on systems whose mbuf zone crosses the bit-30 band the raw low-32 (minus bit 30, which is then known) is disclosed to any LAN client.
• Control entry: byte-identical resend (expected).

Exit code 2 = corruptions reproduced; 0 = raw leak fired; 1 = nothing.

DF-3213 — VERDICT

Status: reproduced. Impact: leak (mechanism proven; raw pointer value gated on heap bit-30 placement) + duplicate-reply-cache integrity corruption. Confidence: certain.

Root cause (line-accurate)

• sys/vfs/nfs/nfs_srvcache.c:337-338 — rc_status = nd->nd_repstat; rp->rc_flag |= RC_REPSTATUS; is the only place RC_REPSTATUS is set.
• No code path in the tree clears RC_REPSTATUS. Slot reuse (nfs_srvcache.c:243-263) clears only RC_REPMBUF (:253-257) and RC_NAM (:258-262). The mbuf-store branch of nfsrv_updatecache (:340-347) clears RC_REPMBUF but not RC_REPSTATUS.
• sys/vfs/nfs/nfsrvcache.h:54-65 — rc_reply (mbuf*) and rc_status (int) are one union (rc_un), so once the reused entry stores a reply mbuf, rc_status reads the low 32 bits of the mbuf pointer.
• sys/vfs/nfs/nfs_srvcache.c:212-216 — the cache-hit path tests RC_REPSTATUS before RC_REPMBUF and calls nfs_rephead(0, nd, slp, rp->rc_status, ...).
• sys/vfs/nfs/nfs_socket.c:1614-1620 — nfs_rephead checks err & NFSERR_AUTHERR (0x40000000, nfsproto.h:100); if bit 30 of the pointer is set it replies MSG_DENIED / rpc_autherr with err & ~NFSERR_AUTHERR raw on the wire (31 pointer bits). Otherwise the value is clamped by nfsrv_errmap (nfs_subs.c:1481-1501) to the per-proc default (NFSERR_IO=5 for v3 REMOVE) — a structurally wrong, status-only reply that is not the cached reply.

How it was reproduced

In-guest (DragonFly dfbsd 6.5-DEVELOPMENT #0 … X86_64_GENERIC, INVARIANTS kernel): /sbin/nfsd -u -n 4, /etc/exports present but irrelevant (no valid filehandle needed). leakforger run as nobody over UDP loopback:

1. 192 v2 SYMLINK (wire proc 13) requests, zero fh → 192 entries with RC_REPSTATUS, rc_status=13 (reply status 0x0d observed).
2. 1856 v2 NULL fillers → cache full at desirednfsrvcache=2048 (nmbclusters=33296 → 16648 → capped 2048; nfsrvcache_size_change, nfs_srvcache.c:129-135).
3. 192 v3 REMOVE (wire proc 12) requests → each evicts one stale entry (LRU head), reuses the slot with RC_REPSTATUS still set, and stores the reply mbuf → RC_REPSTATUS|RC_REPMBUF coexist, union holds the pointer.
4. Retransmit each v3 REMOVE → 192/192 answered with a 7-word status-only reply [xid][1][0][0][0][0][5] instead of the cached reply. Repeats: 192/192 and 256/256 (run.log, run.2.log, run.3.log).

Why status=5 proves pointer aliasing (not merely a stale status)

The genuine stale value is 13 (EACCES). nfsrv_errmap for v3 REMOVE walks nfsv3err_remove[] = {IO, NOENT, IO, ACCES(13), …, STALE, …} and returns an exact match unchanged; 13 would have been returned as 13. The observed 5 is the table default, reachable only for a value that matches no whitelist entry — i.e. rc_status was no longer the small stale errno but the aliased rc_reply mbuf pointer's low 32 bits. The control (fresh entry in a clean slot) resends byte-identically, ruling out re-execution noise.

Impact assessment (honest)

• Proven on this guest (every run): the duplicate reply cache answers retransmissions of non-idempotent operations (REMOVE/RMDIR/RENAME/ SYMLINK/MKNOD/MKDIR/WRITE/SETATTR/CREATE) with a wrong, status-only reply derived from a kernel pointer. Client-visible incorrect NFS results; breaks the exactly-once semantics the cache exists to provide.
• Mechanism-proven, placement-gated: when the cached-reply mbuf lands at an address whose bit 30 is set, err & ~0x40000000 puts 31 bits of the kernel heap pointer into the reply of an unauthenticated remote client. Across 640 poisoned slots on this guest the mbuf zone never had bit 30 set (always clamped), so the raw value was not extracted here; the disclosure is real but conditional on heap placement (memory size/layout).
• Not memory corruption; no write primitive; not a panic. The mreq == NULL no-reply path (nfs_syscalls.c:683-684) leaves INPROG entries that DROP retransmits, but that is cache semantics, not a defect beyond this one.

Fix validation

fix.diff clears RC_REPSTATUS on slot reuse (:253ff) and in the mbuf-store branch of nfsrv_updatecache (:340ff). Applied to the guest's /usr/src, kernel rebuilt with make nativekernel, rebooted, PoC re-run: retransmits then return byte-identical cached replies (0 corruptions) and the control behaves the same. See fix_baseline_reproduced / fix_patched_reproduced fields and run.fixed.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.