DF-3295 — ieee80211_scanreq: signed sr_ssid[i].len passes the > NWID_LEN check; negative value reaches memcpy as (size_t)-1 → unbounded kernel-heap copy

File: sys/netproto/802_11/wlan/ieee80211_ioctl.c (pass 2 audit, GLM 5.3)

What

ieee80211_scanreq() validates each scan-request SSID length with a signed comparison only (ieee80211_ioctl.c:2495-2497):

    for (i = 0; i < sr->sr_nssid; i++)
        if (sr->sr_ssid[i].len > IEEE80211_NWID_LEN)   /* int len */
            return EINVAL;

struct ieee80211_scan_req's embedded SSID is struct { int len; uint8_t ssid[IEEE80211_NWID_LEN]; } (ieee80211_ioctl.h:787-789), so len = -1 (0xffffffff as int) passes (-1 > 32 is false). When the vap is in IEEE80211_S_INIT and the parent is running, the stash branch copies the SSIDs into the vap (ieee80211_ioctl.c:2536-2540):

    for (i = 0; i < sr->sr_nssid; i++) {
        vap->iv_scanreq_ssid[i].len = sr->sr_ssid[i].len;   /* -1 */
        memcpy(vap->iv_scanreq_ssid[i].ssid,   /* 32-byte array inside struct ieee80211vap */
            sr->sr_ssid[i].ssid,               /* 32-byte array inside kmalloc'd sr (copyin'd) */
            sr->sr_ssid[i].len);               /* (size_t)(-1) */
    }

The negative int sign-extends to SIZE_MAX in memcpy's size_t parameter: an unbounded linear kernel-heap copy whose destination starts inside the ieee80211vap (walking forward over the remainder of the vap — including the iv_newstate/iv_reset/iv_key_* function pointers — then adjacent heap objects) and whose source starts at the attacker-supplied 128-byte ieee80211_scan_req (fully user-controlled via the preceding copyin) continuing into adjacent heap.

In the non-INIT branch (ieee80211_ioctl.c:2544-2559) the same signed len is handed to ieee80211_start_scan()/ieee80211_check_scan(), which stash it via ieee80211_scan_copy_ssid (struct memcpy — no immediate overflow there, but the negative len is now resident in scan state for the probe-request builders).

Distinct from DF-0642 (signed sr_nssid → ieee80211_scan.c copy_ssid memcpy, non-INIT branch): this finding is the signed sr_ssid[].len field reaching the ioctl.c memcpy in the INIT branch — different field, different sink, complementary preconditions.

Reproduced (stock INVARIANTS kernel #0)

mlme DISASSOC -> 0            (vap S_SCAN -> S_INIT while UP; ic_nrunning stays 1)
firing SCAN_REQ: sr_nssid=1 sr_ssid[0].len=-1
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xfffff80118830000     (kernel heap, write side)
fault code = supervisor write data, page not present
current process = 1229 (scanreq)
Stopped at memcpy+0xfa: repe movsq (%rsi),%es:(%rdi)

Guest down at the first INIT-branch attempt. (The first loop iteration hit the non-INIT branch and returned EINPROGRESS=36, storing the negative len in scan state — the second iteration, after the MLME pushed the vap to S_INIT, hit the memcpy.)

Primitive characterization

• write: linear overwrite from &vap->iv_scanreq_ssid[0].ssid forward across the whole tail of the ieee80211vap (function pointers!) and adjacent kernel heap, until the first unmapped page.
• data: first 128 bytes fully attacker-controlled (the copyin'd ieee80211_scan_req), beyond that adjacent-heap contents.
• gate: SIOCS80211 requires SYSCAP_NONET_WIFI (ieee80211_ioctl.c:3472). No unprivileged path exists, so an unprivileged user→root chain is not reachable; the ceiling is a delegated-capability user converting wifi-admin into full kernel compromise (heap-groom a victim object behind the vap, overwrite with controlled bytes, pivot through iv_newstate-style calls), or trivially a guaranteed panic.

Build / run (repo root)

sh findings/poc/DF-3295/build.sh    # fw.ko (software radio) + scanreq in guest
sh findings/poc/DF-3295/run.sh      # baseline: fatal trap 12 at the ioctl

Harness (fw.c) is DF-3282's software net80211 radio, unchanged: registers fw0 (STA/hostap/ibss capable), nop scan callbacks. Trigger creates a STA vap, brings it UP (→ S_SCAN), uses MLME DISASSOC to return it to S_INIT while UP, then fires the SCAN_REQ with sr_ssid[0].len = -1, retrying.

Fix validation

fix.diff rejects sr_ssid[i].len < 0 (and sr_nssid < 0) with EINVAL. Patched kernel (#1, built in-guest): every attempt returns EINVAL, no panic, guest stays up, wlan0 functional, and a valid scan request (len=4) is still accepted (rc=0 via the INIT stash path).

DF-3295 — VERDICT

Status: reproduced (impact: panic — memory-corruption primitive characterized; escalation ceiling is delegated-cap → kernel compromise, there is no unprivileged entry path).

Finding

ieee80211_scanreq() (sys/netproto/802_11/wlan/ieee80211_ioctl.c) validates scan SSID lengths with a signed-only upper bound:

• ieee80211_ioctl.c:2495-2497 — if (sr->sr_ssid[i].len > IEEE80211_NWID_LEN) return EINVAL; (sr_ssid[i].len is int, ieee80211_ioctl.h:788)

Sink, INIT branch (vap in IEEE80211_S_INIT, ic_nrunning != 0, ieee80211_ioctl.c:2526-2543):

• ieee80211_ioctl.c:2538-2540 — memcpy(vap->iv_scanreq_ssid[i].ssid, sr->sr_ssid[i].ssid, sr->sr_ssid[i].len) with len = -1 → SIZE_MAX.

Secondary (non-INIT branch): ieee80211_ioctl.c:2544-2559 passes the signed len into the scan machinery (ieee80211_start_scan / ieee80211_check_scan), where ieee80211_scan_copy_ssid (ieee80211_scan.c:305) struct-copies it into scan state (no immediate overflow; negative len resident for later probe construction). The signed sr_nssid sibling on that scan.c sink is DF-0642 — this finding is the sr_ssid[].len field and the ioctl.c memcpy, i.e. not a re-report.

How it was reproduced

1. sh findings/poc/DF-3295/build.sh — builds DF-3282's software radio KLD (fw.ko: registers fw0, STA/hostap/ibss capable, nop scan callbacks) + scanreq trigger on the guest (stock INVARIANTS kernel #0, DragonFly 6.5-DEVELOPMENT).
2. ifconfig wlan create wlandev fw0 wlanmode sta up — vap UP; state machine reaches S_SCAN (status: no carrier).
3. ./scanreq wlan0: * ioctl(SIOCS80211, MLME DISASSOC) → 0 — STA-mode DISASSOC does ieee80211_new_state(vap, IEEE80211_S_INIT, reason) (ieee80211_ioctl.c:1396-1400) while the interface stays UP, so ic_nrunning stays 1. * ioctl(SIOCS80211, SCAN_REQ, {nssid=1, ssid[0].len=-1}): first iteration hit the SCAN-state branch (returned EINPROGRESS=36 — the negative len entered scan state via copy_ssid); after the next MLME the vap was in S_INIT and the stash-branch memcpy ran.
4. Result (run.log / panic.txt): Fatal trap 12: page fault while in kernel mode, fault virtual address = 0xfffff80118830000, supervisor write data, current process = 1229 (scanreq), Stopped at memcpy+0xfa: repe movsq — the destination walk off the vap hit an unmapped kernel page. Guest down; vm.sh status ⇒ down.

Primitive

• Destination: &vap->iv_scanreq_ssid[0].ssid — 32-byte array inside the heap-allocated ieee80211vap; the copy walks the entire vap tail (iv_scanreq_ssid[1..2], and everything after: including function pointers iv_newstate, iv_reset, iv_key_alloc, iv_key_set, …) and then adjacent kernel heap.
• Source: the 128-byte kmalloc'd ieee80211_scan_req, fully attacker-controlled (copyin at ieee80211_ioctl.c:2583), then adjacent heap.
• Length: SIZE_MAX — copy runs until the fault; on this guest ~the distance to the next unmapped kernel page.

uid0? Not reachable by an unprivileged user: the only entry is SIOCS80211, gated by caps_priv_check_self(SYSCAP_NONET_WIFI) (ieee80211_ioctl.c:3472). Escalation ceiling = a user delegated SYSCAP_NONET_WIFI (wifi administrator) can groom the heap so a chosen object follows the vap and convert this into controlled-pointer overwrite → kernel code exec → full root; or trivially panic. Filed Medium (privileged heap corruption; deterministic local DoS is the demonstrated floor).

Fix validation (fix.diff)

vm.sh reset with-src → applied fix.diff (reject sr_ssid[i].len < 0 and sr_nssid < 0 with EINVAL) in the guest /usr/src → make nativekernel KERNCONF=X86_64_GENERIC → make installkernel → reboot (kernel #1, Thu Sep 10 07:24:45 UTC 2026) → re-ran the exact PoC:

• All 11 attempts: scanreq -> -1 (errno 22) (EINVAL) — the fix's rejection path. No trap, no panic; vm.sh status ⇒ up; wlan0 still responds (ifconfig wlan0 fine).
• Regression: valid SCAN_REQ (len=4) accepted (rc=0 via the INIT stash path; normal behavior), guest healthy.

Baseline vs patched: fatal trap 12 + guest down → clean EINVAL + guest up. fix_status: fixed.

Notes / honesty

• errno 36 (EINPROGRESS) on the non-INIT first iteration is normal scan behavior, not an error of the PoC.
• The guest was reset (vm.sh reset with-src) after validation; no dirty state left behind.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.