DF-3303 VERDICT — INCONCLUSIVE on guest (race certain by inspection)

Bottom line

The locking violation is unambiguous in the code: del_mfc() and del_bw_upcall(BW_UPCALL_DELETE_ALL) call free_bw_list() after releasing mroute_token, and free_bw_list() → unschedule_bw_meter() walks and unlinks from the global bw_meter_timers[] hash with no token (ip_mroute.c:1115-1118, :2365-2368, :2653-2672) while the 1 Hz bw_meter_process() callout (token held, :2684-2766) disconnects and relinks whole buckets. A colliding free-walk either trips panic("unschedule_bw_meter: bw_meter entry not found") (:2663) or operates on memory the callout is concurrently rescheduling (UAF). FreeBSD performs this exact free under the routing lock.

Six escalating attempts on the guest (up to 240 s each: 4 adder threads + 4 deleter threads at 10 ms + traffic suppression of the upcall storm; earlier variants with 120k-300k meter bursts) did not land the race:

• the deleter's detach (mfc_find + list detach) needs mroute_token, which the callout holds for its whole bucket walk — so deletes serialize behind the walk instead of overlapping it;
• the free walk itself is fast (schedule pushes bucket head, and the mfc list is walked newest-first), leaving only a ~0.1-1% duty-cycle window per 1 Hz tick for the required interleaving.

Observed collateral during the attempts (recorded, not filed separately): - bw_upcalls_send() (:2571-2578) does MGETHDR then m_copyback of up to BW_UPCALLS_MAX * sizeof(struct bw_upcall) = 10 KB into a header mbuf with no cluster: m_copyback prints m_copyback: unexpected mbuf expansion required, code path needs to be fixed and the upcalls are truncated — every 128 prepared upcalls when thresholds are zero. Real bug (silent upcall loss + console spam), Low. - meters left scheduled after the daemon dies churn the 1 Hz callout forever (self-sustaining upcall storm, minutes-long console flood, ssh starvation) — robustness note.

Verdict

inconclusive: reproduced=0 on the guest in the time available; the finding stands on code inspection (confidence: likely; manifestation timing-dependent). Trigger is privileged (MRT_DEL_MFC / MRT_DEL_BW_UPCALL), so severity Medium at most, matching the DF-0306 family profile.

Fix (validated by build+boot, no crash regression in 45 s bwrace run)

Move the frees under the token (see fix.diff):

    list = mfc->mfc_bw_meter;
    mfc->mfc_bw_meter = NULL;
-   lwkt_reltoken(&mroute_token);
    free_bw_list(list);
+   lwkt_reltoken(&mroute_token);

(and the same reordering in del_mfc).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.