GANN propagation gate uses && where || is required: TTL-exhausted GANNs re-broadcast with TTL wrapping 0 to 255
Summary
The comment says 'propagate only if decremented ttl >= 1 && forwarding is enabled' but the code returns only when BOTH (ttl-1)<1 AND forwarding disabled; with the default FWD flag set every accepted GANN is re-broadcast regardless of TTL, and pgann.gann_ttl = ie.gann_ttl - 1 in uint8 arithmetic wraps 0 -> 255 (hopcount likewise wraps 255 -> 0), granting exhausted announcements a fresh full TTL budget at every hop. VERIFIED: one well-formed GANN with ttl=0; captured re-broadcast carries TTL=0xff. 802.11s hop-limit defeat and mesh-wide announcement amplification, bounded only by the wrap-unsafe (DF-0290) per-gate sequence dedup. Fix validated (&& -> ||): no propagation.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3291 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 1.7 KB | ↓ raw | |
| run.sh | — | 111 B | view raw | |
| verdict.json | — | 2.1 KB | view raw | |
| manifest.json | — | 393 B | view raw |
DF-3291 — GANN propagation gate uses && where || is required: TTL-exhausted GANNs re-broadcast with TTL wrapping 0→255
File: sys/netproto/802_11/wlan/ieee80211_mesh.c (pass 2 audit)
What
/* popagate only if decremented ttl >= 1 && forwarding is enabled */
if ((ie.gann_ttl - 1) < 1 && !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD))
return 0;
...
pgann.gann_hopcount = ie.gann_hopcount + 1;
pgann.gann_ttl = ie.gann_ttl - 1; /* uint8_t: 0 - 1 -> 255 */
(:2690-2694)
The comment states the intended condition (propagate only if ttl-1 ≥ 1
and forwarding enabled) but the code ORs nothing: with the default
IEEE80211_MESHFLAGS_FWD set (mesh_vattach :683 sets AP|FWD), the
&& !(FWD) term is always false, so every accepted GANN is
re-broadcast regardless of TTL. A TTL=0 GANN is forwarded with
pgann.gann_ttl = (uint8_t)(0 - 1) = 255,
violating the 802.11s hop limit and re-injecting the announcement with a
fresh full TTL budget (hopcount also wraps 255→0). The next hop's
(255-1) < 1 check is again defeated by the same &&. Only per-gate
sequence dedup (itself not wrap-safe, DF-0290) bounds the flood.
Reproduced (stock kernel)
Injected well-formed GANN with ttl=0 (harness step 22); victim re-broadcast (captured):
tx[28] ... 0d 02 7d 0f 00 01 ff 02:00:00:02:00:40 01000000 1000
^^ TTL=0xff
hopcount incremented, TTL = 255.
Build / run
sh findings/poc/DF-3286/build.sh sh findings/poc/DF-3291/run.sh
Threat
Spec violation + mesh-wide announcement amplification with defeated TTL
(bounded only by seq dedup). Severity Low (protocol/logic; DoS
amplification marginal). Fix: && → || (fix.diff hunk 6).
Fix verification
fixedGANN ttl=0 no longer propagated (baseline: re-broadcast with TTL=0xff); && -> || gate stops TTL-exhausted GANNs
['fix.log: no len-43 propagated frame after step 22']
Confirmed kernel references
Detail
Exploit chain
established peer sends CAT_MESH GANN with ttl=0 -> condition false (FWD default) -> re-broadcast with ttl=255 -> next hops likewise never TTL-stop while FWD set
Evidence (decisive lines)
run.log (shared with DF-3290): tx[28] propagated GANN TTL=ff
PoC changes
harness step 22
Verified recommended fix
change && to || in the propagation condition (fix.diff hunk 6)
Verdict
The GANN propagation gate (ttl-1 < 1 && !FWD) is always false when the default FWD flag is set, so TTL-exhausted GANNs are re-broadcast; pgann.gann_ttl = ie.gann_ttl - 1 in uint8 arithmetic wraps 0 to 255. Injected a well-formed ttl=0 GANN and captured the victim's re-broadcast carrying TTL=0xff and hopcount+1 - the hop limit is defeated and the announcement gets a fresh 255-TTL budget (hopcount also wraps 255->0). Bounded only by per-gate seq dedup; protocol/logic defect with marginal amplification.
No comments yet.