DF-3305 VERDICT — REPRODUCED (deterministic NULL deref → kernel panic)

Bottom line

del_vif() leaves the tbf_reprocess_q_ch callout armed with vifp as its argument; it then bzeros the vif (and its tbf) so vifp->v_tbf becomes NULL, and when the 10 ms callout fires it dereferences t->tbf_last_pkt_t → Fatal trap 12 at virtual address 0x8. Reproduced on the guest on the first qualifying iteration (after fixing the PoC to actually reach the tbf path). Trigger is privileged (MRT_DEL_VIF), so severity is Low (root can crash the box — but a routing daemon restart sequence del_vif at the wrong moment is enough; no malicious intent needed).

Root cause (citations sys/net/ip_mroute/ip_mroute.c)

• :1791-1793 tbf_control() arms the global callout with vifp when a packet is queued on a rate-limited vif: callout_reset(&tbf_reprocess_q_ch, TBF_REPROCESS, tbf_reprocess_q, vifp);
• :873-923 del_vif() frees the queued mbufs and bzeros vifp (v_tbf becomes NULL) under mroute_token — but never stops the callout. (X_ip_mrouter_done does stop it, at :644 — del_vif forgot.)
• :1873-1885 tbf_reprocess_q(vifp) only checks ip_mrouter == NULL, then :1961-1972 tbf_update_tokens() does struct tbf *t = vifp->v_tbf; and TV_DELTA(tp, t->tbf_last_pkt_t, tm) → NULL+0x8 read.

Reproduction (guest, PIMTEST kernel #0)

MRT_INIT: 0
iter 0: sent, DEL_VIF rc=0; waiting for callout...

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x8                    <- &tbf_last_pkt_t.tv_usec - NULL
Stopped at      tbf_update_tokens.isra.11+0x2a:  subq 0x8(%rbx),%rax  <- rbx = t = NULL

(runs: first attempt with 200 iterations did not panic because a raw socket without IP_MULTICAST_TTL gets its TTL forced to 1 by ip_output and X_ip_mforward drops TTL<=1 before reaching the vif; with the TTL option attached, the panic is immediate — see poc_changes.)

Fix validation (kernel #1)

Patched del_vif stops the callout and tbf_reprocess_q guards v_tbf == NULL; ./tbfcallout completes 200 iterations: no panic after 200 iterations (fix_run.log).

Recommended fix

+    callout_stop(&tbf_reprocess_q_ch);
     bzero((caddr_t)vifp->v_tbf, sizeof(*(vifp->v_tbf)));

plus if (ip_mrouter == NULL || vifp == NULL || vifp->v_tbf == NULL) return; in tbf_reprocess_q (see fix.diff).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.