DF-3273 — Remote peer one-frame kernel panic via CONF-NAK/REJ with h->len < 4

What

sppp_cp_input() clamps len = min(m->m_pkthdr.len, ntohs(h->len)) and only re-validates len < 4 for CONF_REQ (if_spppsubr.c:1417). CONF_NAK/CONF_REJ are dispatched to the RCN_nak/RCN_rej handlers with len ∈ {0,1,2,3} (if_spppsubr.c:1541-1544). Every handler starts with

len -= 4;
buf = kmalloc(len, M_TEMP, M_INTWAIT);   /* len is now -4..-1 */

kmalloc((size_t)-4) reaches the oversized path in kern_slaballoc.c, round_page(0xFFFFFFFFFFFFFFFC) wraps to 0, and the degenerate zero-length kmem_slab_alloc() corrupts the kernel map — instant panic:

panic: vm_map_entry_link: dup addr map 0xffffffff8159eea0 ent 0xffffffff81604448
kmem_slab_alloc() at kmem_slab_alloc+0x145
_kmalloc() at _kmalloc+0x5be

The only gate is h->ident == sp->confid[cp->protoidx]; confid[] is 0 from attach until the first CONF-REQ, and is otherwise readable off the wire, so an unauthenticated PPP peer needs exactly ONE frame.

Files

• poc_3273.c — the trigger (injects one 8-byte LCP CONF-NAK, h->len=0)
• sppp_harness.c — PoC harness module (models the sync-PPP driver: allocates a real struct sppp, attaches via sppp_attach(), feeds frames to sppp_input() via /dev/spppinj0, exactly like ng_sppp.c does)
• panic.txt — serial-console panic from the baseline run
• env.txt — guest uname etc.
• fix.diff — the len<4 guard in sppp_cp_input (also fixes DF-3272)

Build / run (inside the guest, as root)

# harness module (needs /usr/src kernel source)
cd /root/poc
cat > Makefile <<'EOF'
KMOD= sppp_harness
SRCS= sppp_harness.c
KMODDIR= /root/poc
.include <bsd.kmod.mk>
EOF
make
cc -O2 -o poc_3273 poc_3273.c
kldload /root/poc/sppp_harness.ko     # pulls in stock sppp.ko
/root/poc/poc_3273                    # -> kernel panics (ssh dies)

Expected

Baseline (stock sppp.ko): instant panic, vm.sh status => down (DDB). With fix.diff applied to if_spppsubr.c and sppp.ko rebuilt+installed: "write returned 8 / kernel still alive" — frame rejected, no panic.

DF-3273 — reproduced (panic) on the stock INVARIANTS guest; fixed by fix.diff.

How it was reproduced

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS), source tree md5-identical to the audited tree. Because sppp is driver-fed (the only in-tree consumer is netgraph7/ng_sppp.c, which currently does not compile — DF-0721/0720), the peer was modeled the way the harness note prescribes: a PoC module (sppp_harness.c) allocates a real struct sppp in its own softc (the classic sync-driver pattern), attaches it with sppp_attach()/if_attach(), and forwards /dev/spppinj0 writes to sppp_input() one-mbuf-per-write — the same contract ng_sppp.c:ng_sppp_rcvdata() implements. The sppp code under test is the unmodified stock /boot/kernel/sppp.ko.

poc_3273 injects a single 8-byte frame: ff 03 c0 21 | 03 00 00 00 (LCP CONF-NAK, id=0, h->len=0) -> sppp_cp_input len = min(pkthdr.len=4, h->len=0) = 0 -> CONF_NAK dispatch -> sppp_lcp_RCN_nak(sp, h, 0) -> len = -4 -> kmalloc(0xFFFFFFFFFFFFFFFC, M_TEMP, M_INTWAIT) -> kern_slaballoc.c oversized path: round_page() wraps to 0 -> kmem_slab_alloc(0) degenerate insert -> panic (panic.txt):

panic: vm_map_entry_link: dup addr map 0xffffffff8159eea0 ent 0xffffffff81604448 vm_map_set_wired_quick() at vm_map_set_wired_quick+0x20 kmem_slab_alloc() at kmem_slab_alloc+0x145 _kmalloc() at _kmalloc+0x5be

One frame, unauthenticated peer, deterministic across resets. The identical code path exists in all six RCN handlers (lcp/ipcp/ipv6cp x rej/nak: if_spppsubr.c:2419, 2492, 3090, 3142, 3530, 3581).

Fix validation

fix.diff adds the same len < 4 guard to the CONF_NAK/CONF_REJ arm of sppp_cp_input that CONF_REQ already has (mirrors if_spppsubr.c:1417). Applied to /usr/src/sys/net/sppp/if_spppsubr.c in-guest, module rebuilt with -Werror (clean), installed to /boot/kernel/sppp.ko, guest rebooted: poc_3273 -> "write returned 8", kernel stays up, frame counted as ierror. No behavior regression: LCP negotiation proceeds normally (verified by the DF-3272 driver on the same patched module).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.