DF-3297 — pf DIOCGETSRCNODES leaks kernel heap pointers (RB-tree links)

What

pfioctl() DIOCGETSRCNODES copies each struct pf_src_node to userland with a raw bcopy(n, pstore, sizeof(*pstore)) (pf_ioctl.c:2884) followed by copyout (pf_ioctl.c:2902). The only sanitization is a 4-byte store pstore->rule.nr = n->rule.ptr->nr (pf_ioctl.c:2886) into the 8-byte union pf_rule_ptr. Leaked verbatim:

• entry.rbe_left / entry.rbe_right / entry.rbe_parent — raw RB-tree kernel heap pointers (non-NULL whenever a per-cpu src tree holds >=2 nodes)
• the upper 4 bytes of rule.ptr (the union's high half survives the u32 nr store)
• kif (always NULL today — pf_insert_src_node, pf.c:582-599, never sets it — but is copied raw)

Sibling of the DF-0277 (DIOCGETRULE) / DF-0278 (DIOCGETADDR) / DF-0279 (DIOCGETALTQ) leak family — different ioctl, not covered by those findings. Unlike those, DIOCGETSRCNODES is in the FREAD allow list (pf_ioctl.c:1069), so a read-only /dev/pf fd suffices wherever one is granted.

Reachability

/dev/pf is 0600 root:wheel on a stock system (pf_ioctl.c:3360), so on stock this is a root-visible pointer disclosure (KASLR-defeat class). Setups that relax devfs permissions for monitoring (pfctl -s Sources uses this ioctl) expose it to non-root readers.

Reproduce

kldload pf.ko
pfctl -f srcnodes.conf && pfctl -e
for i in 2 3 4 5 6 7 8; do ifconfig lo0 127.0.0.$i netmask 255.0.0.0 alias; done
for ip in 127.0.0.2 ... 127.0.0.8; do ./conn2 $ip & done; wait   # >=2 nodes/cpu
cc -O2 -o leak_srcnodes leak_srcnodes.c
./leak_srcnodes        # opened O_RDONLY

Expected

node 1:
  +0000: 0xfffff8008bb64460   <-- kernel pointer   (rbe_left)
  +0008: 0xfffff8008bb645a0   <-- kernel pointer   (rbe_right)
node 0:
  +0010: 0xfffff8008bb64500   <-- kernel pointer   (rbe_parent)

(genuine DFly kernel-heap addresses 0xfffff8xx_xxxxxxxx; stable across consecutive dumps — see leak_sample.txt)

DF-3297 VERDICT — reproduced (kernel heap-pointer disclosure, read-only fd)

Result

status: reproduced, impact: leak (raw kernel heap pointers disclosed to userland through a read-only /dev/pf descriptor).

How it was run

Guest (same boot as DF-3296 baseline work): pf.ko loaded, one keep state (max-src-states 100) rule on lo0:65001, lo0 aliases 127.0.0.2-8 added, one TCP connect per alias. leak_srcnodes opens /dev/pf with O_RDONLY (proving the FREAD-allow-list path) and dumps DIOCGETSRCNODES output qword-by-qword.

Observed (see leak_sample.txt / run.log): - rbe_left / rbe_right / rbe_parent at +0x00/+0x08/+0x10 hold genuine kernel-heap pointers (0xfffff8008bb64460, 0xfffff8008bb645a0, 0xfffff8008bb64500, 0xfffff8011757d6e0, ...). - Pointers are stable across consecutive dumps (same addresses minutes apart) — deterministic disclosure, not noise. - +0x40 (union pf_rule_ptr): only the low 4 bytes are overwritten with nr (pf_ioctl.c:2886); the pointer's upper half would leak verbatim for rules with source-tracking (non-NULL rule.ptr). In these runs the nodes had rule.ptr == NULL (observed zero at +0x40; the kernel's own if (n->rule.ptr != NULL) guard at pf_ioctl.c:2885 corroborates), so this half-leak is code-certain but not directly demonstrated — the RB links are the unambiguous, reproduced disclosure.

Root cause

pf_ioctl.c:2884 raw bcopy of struct pf_src_node (which embeds RB_ENTRY(pf_src_node) entry, three pointers) with no zeroization; only rule.nr is sanitized (pf_ioctl.c:2886). Same defect family as DF-0277/0278/0279 — this ioctl was missing from that set.

Impact ceiling

Kernel heap-address disclosure (KASLR-defeat / heap-layout oracle) for anyone with read access to /dev/pf (root on stock; non-root where devfs rules grant it, e.g. monitoring accounts). No direct memory-safety impact; severity Low.

Fix

fix.diff: zero the linkage/pointer fields of the copy before copyout (pstore->entry links, pstore->kif, full pstore->rule union) — mirrors what pfctl actually consumes (addr/raddr/counters/rule.nr). Not build-validated (Low, non-corruption class; validation reserved for memory-corruption findings per contract) — the patch is two bzero/field stores, compile-checked by inspection.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.