DF-3300 — SIOCSVH accepts advbase=0 (missing lower-bound validation)

Static claim

sys/netinet/ip_carp.c:2463-2474 (carp_ioctl_setvh_dispatch):

if (carpr->carpr_advbase > 0 || carpr->carpr_advskew > 0) {
        if (carpr->carpr_advskew >= 255) { error = EINVAL; goto back; }
        if (carpr->carpr_advbase > 255)  { error = EINVAL; goto back; }
        sc->sc_advbase = carpr->carpr_advbase;   /* 0 accepted here */
        sc->sc_advskew = carpr->carpr_advskew;
        error--;
}

There is no advbase <= 0 rejection: a request carrying advskew>0 and advbase=0 stores sc_advbase = 0, which collapses the advertisement interval to tick-resolution (tv.tv_sec = 0) in carp_setrun() (ip_carp.c:1839-1841) and the master-down timeout to 3*0 = 0 s (ip_carp.c:1812). FreeBSD's carp validates carpr_advbase <= 0 || > 255 -> EINVAL; OpenBSD likewise rejects <= 0.

Reproduced (guest, stock kernel, ifconfig only)

# ifconfig carp0 vhid 1 pass pocpass advbase 1 advskew 0; ... up; (force MASTER)
# ifconfig carp0 advskew 100
# ifconfig carp0 advbase 0
carp: MASTER vhid 1 advbase 0 advskew 100        <- 0 accepted & stored
# 3 s of advertisements:
   14 -> 21 packets sent   (advbase 0, advskew 100: ~2.3 ads/s)
# ifconfig carp0 advskew 1
  21 -> 171 packets sent   (advbase 0, advskew 1: 50 ads/s = tick rate)

50 advertisements/second per carp(4) interface vs the protocol minimum of 1/s (advbase>=1) — an L2/IGMP-state/CPU flood from one config line. Trigger is privileged (root ifconfig), so severity: Low (validation gap / foot-gun), but it also breaks the CARP protocol invariant (RFC-style advbase >= 1s) that peer implementations rely on for failover math.

Fix

-       if (carpr->carpr_advbase > 255) {
+       if (carpr->carpr_advbase == 0 || carpr->carpr_advbase > 255) {
            error = EINVAL;
            goto back;
        }
+       /* keep current advbase if caller passes 0 */

i.e. mirror FreeBSD:

sc->sc_advbase = carpr->carpr_advbase ? carpr->carpr_advbase
                                      : CARP_DFLTINTV;

Files

• run1.log / run2.log — guest console transcripts (ifconfig + netstat)