DF-3296 — pf DIOCCHANGEADDR: removing a pool's LAST address NULL-derefs the kernel

What

pfioctl() DIOCCHANGEADDR with action = PF_CHANGE_REMOVE frees the selected struct pf_pooladdr and then unconditionally does (pf_ioctl.c:2330-2332):

pool->cur = TAILQ_FIRST(&pool->list);          /* NULL when pool now empty */
PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, pca->af);

PF_ACPY -> pf_addrcpy() (pf.c:411) reads src->addr32[0] at virtual address 0 -> fatal page fault. With pca->af = AF_UNSPEC the copy is a no-op, the ioctl returns success, and the owning rule is left with rpool.cur == NULL — the next packet matching that nat/rdr/binat/route-to rule NULL-derefs in pf_map_addr() (pf.c:2693/2712).

Reachability

• /dev/pf is created 0600 root:wheel (pf_ioctl.c:3360) and DIOCCHANGEADDR is a write ioctl (not in the FREAD allow-list, pf_ioctl.c:1047-1098) -> requires root (or a devfs rule granting write).
• Deterministic: one ioctl sequence, no race, 100% reproducible.

Reproduce

kldload pf.ko                       # if not loaded
cc -O2 -o trigger_changeaddr trigger_changeaddr.c
./trigger_changeaddr                # ioctl variant: panic in pf_addrcpy
# ./trigger_changeaddr datapath enable   # packet variant: panic in pf_map_addr

Expected

ioctl variant (baseline, stock pf.ko):

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x0
fault code = supervisor read data, page not present
Stopped at      pf_addrcpy+0x11:        movl    (%rsi),%eax

packet variant (baseline): Stopped at pf_map_addr+0x76: movzbl 0x28(%rbx),%ecx

Fix validation

fix.diff: refuse removing the last pool address (EBUSY) + defensive NULL guard around the PF_ACPY. Validated by rebuilding only the pf kernel module in the guest:

cd /usr/src && patch -p0 < fix.diff
cd /usr/src/sys/net/pf && make obj && make
kldload /usr/obj/usr/src/sys/net/pf/pf.ko
./fixcheck        # remove non-last: OK; remove last: "Device busy", no panic
./trigger_changeaddr   # "ioctl returned Device busy (no panic?)"

Note for the datapath variant re-run: leave DIOCSTART out or bind the test NAT rule to lo0 — an unconstrained nat -> 10.9.9.9 rule with pf enabled NATs the ssh session itself and black-holes guest networking (kernel stays up; this is a harness artifact, not the bug).

DF-3296 VERDICT — reproduced (deterministic kernel NULL-deref panic; DoS class)

Result

status: reproduced, impact: panic (deterministic local kernel panic; write-access to /dev/pf required, i.e. root on a stock system — /dev/pf is crw------- root:wheel, pf_ioctl.c:3360).

How it was run (baseline, stock pf.ko, guest #0 X86_64_GENERIC)

1. kldload pf.ko; build trigger_changeaddr.c (plain cc, structs from the installed <net/pf/pfvar.h>, sizes verified identical to kernel: pfioc_pooladdr=1136, pf_pooladdr=88).
2. The trigger performs, all on one /dev/pf fd (O_RDWR): DIOCBEGINADDRS -> DIOCADDADDR(10.9.9.9/32) -> DIOCXBEGIN(NAT) -> DIOCADDRULE(one nat rule, pool_ticket matched) -> DIOCXCOMMIT -> DIOCGETRULES (fetch ACTIVE ticket) -> DIOCCHANGEADDR(action=PF_CHANGE_REMOVE, nr=0, r_num=0, r_action=PF_NAT, af=AF_INET).
3. Kernel panicked before the ioctl returned (ssh died, vm status down):

Fatal user address access from kernel mode from trigger_changead at ffffffff82607d31
Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x0
fault code               = supervisor read data, page not present
Stopped at      pf_addrcpy+0x11:        movl    (%rsi),%eax

%rsi = &pool->cur->addr.v.a.addr with pool->cur == NULL — the exact predicted sink pf_ioctl.c:2330-2332 -> pf_addrcpy (pf.c:411-426).

4. Variant 2 (same binary, datapath enable): removal with af=AF_UNSPEC (pf_addrcpy copies nothing -> no ioctl panic; rule left with an empty pool), then DIOCSTART + one UDP packet to 127.0.0.1:65001 matching the NAT rule:

Stopped at      pf_map_addr+0x76:       movzbl  0x28(%rbx),%ecx

rbx == rpool->cur == NULL (pf.c:2693/2712). Two independent panic sites from one root cause — the invariant "a pool-using rule always has >=1 address" (enforced at rule creation, pf_ioctl.c:1262-1266 and 1500-1506) is breakable after commit via DIOCCHANGEADDR.

Root cause

• pf_ioctl.c:2313-2318: PF_CHANGE_REMOVE frees the last pooladdr with no emptiness check.
• pf_ioctl.c:2330-2332: unconditional pool->cur = TAILQ_FIRST(...) followed by an unchecked pool->cur->addr... dereference.
• pf.c:2693/2712: packet path also assumes rpool->cur != NULL.

Exploitability ceiling (why DoS, not more)

The primitive is a read from a fixed virtual address 0 (offsetof(struct pf_pooladdr, addr) == 0; v.a.addr at offset 0 of pf_addr_wrap) into the kernel-owned pool->counter — 4 bytes (AF_INET) or 16 (AF_INET6). The faulting address is not attacker-influenced (always NULL+0) and nothing is copied to userland; a NULL page mapping is not attainable for unprivileged users on DragonFly (no MAP_FIXED at 0; vm.mmap_min_addr equivalent enforced by sys/sysref/mmap checks). Both panic sites are identical fixed-NULL reads. Conclusion: unexploitable beyond panic/denial-of-service. No uid=0 chain is possible from this bug; pushed to the honest ceiling (two deterministic panic variants + fix validation).

Fix (validated)

fix.diff: 1. refuse PF_CHANGE_REMOVE of the last pool address (EBUSY) — restores the creation-time invariant for live rules; 2. defensive if (pool->cur != NULL) around the PF_ACPY. Validation (same guest, module-only rebuild): - baseline reproduced first (panic captured above, panic.txt); - cd /usr/src && patch -p0 < fix.diff && cd sys/net/pf && make obj && make; - kldload patched pf.ko; - ./trigger_changeaddr -> ioctl returned Device busy (no panic?) — identical trigger, panic GONE; - ./fixcheck (pool with 2 addresses): remove #1 (non-last) succeeds (fix does not over-block), remove #2 (last) -> Device busy, no panic; - datapath variant post-fix: removal refused (EBUSY) so pf_map_addr never sees an empty pool. (Caveat recorded in README: re-running with DIOCSTART + an unconstrained nat rule NATs the ssh flow itself — harness artifact, kernel stays alive.) fix_status: fixed.

Files

trigger_changeaddr.c (both variants), fixcheck.c (fix validation), build.sh / run.sh, build.log, run.log (patched), panic.txt (both panics), fix.diff, env.txt, manifest.json, verdict.json.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.