DF-3307 — stale exthdrs[] pointers across pfil_run_hooks() → use-after-free read+write in ip6_output() fragmentation

File: sys/netinet6/ip6_output.c (pass-2 audit, GLM 5.3) Class: kernel memory corruption (use-after-free write of one controlled byte + stale read that feeds the emitted fragment's ip6f_nxt), packet corruption. Gate: root-set Hop-by-Hop (or Dest1/Rthdr) option + any inet6 PFIL_OUT hook that replaces the mbuf chain (e.g. firewall normalization). No unprivileged trigger exists on a stock system (hbh/dest/rthdr options are privilege-gated at ip6_setpktoption, ip6_output.c:2763/2794), hence severity Low, but the primitive itself is a genuine kernel UAF and is fully demonstrated here.

What is in this pack

Reproduce (summary — full detail in VERDICT.md)

1. Copy instr-ip6_input.c over the guest's /usr/src/sys/netinet6/ip6_input.c
2. cd /usr/src && make quickkernel KERNCONF=X86_64_GENERIC -DNO_WERROR && make installkernel KERNCONF=X86_64_GENERIC, reboot
3. ifconfig lo0 mtu 1500; build trigger.c; start tcpdump -i lo0 -U -w cap.pcap ip6
4. sysctl net.inet6.ip6.pfildemo_enable=1 then run ./trigger → vulnerable kernel: receiver: no datagram; wire shows hbh.nxt 11 (fragment header unreachable → receivers parse a bogus UDP header)
5. sysctl net.inet6.ip6.pfildemo_enable=0 (control) then ./trigger → datagram delivered; wire shows hbh.nxt 2c
6. Apply fix.diff to the guest's ip6_output.c, quickkernel+installkernel, reboot, repeat step 4 with enable=1 → fixed kernel: datagram delivered, hbh.nxt 2c even though the chain was replaced

Expected result table (observed)

DF-3307 VERDICT — reproduced (use-after-free write, root-gated)

Bottom line

ip6_output() fills exthdrs.ip6e_hbh/dest1/rthdr with pointers into the packet's mbuf chain before running the pfil output hooks (sys/netinet6/ip6_output.c:164-173, chained at :249-282). pfil_run_hooks() (sys/net/pfil.c) hands every hook struct mbuf **mp and hooks are allowed to free the chain and substitute a copy while still returning success — exactly what a normalizing firewall does. After the hooks, ip6_output re-derives only ip6 (:662) and keeps using the stale exthdrs[] pointers in the fragmentation path:

• read: nextproto = *mtod(exthdrs.ip6e_hbh, u_char *) (:785, :782, :779)
• write: *mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT (:786, :783, :780)

Both operate on freed memory once a hook replaced the chain. The stale write puts byte 0x2c at the start of the freed (cluster-backed) hbh header; the stale read decides the ip6f_nxt protocol byte of every emitted fragment.

How it was demonstrated (guest: DragonFly 6.5-DEVELOPMENT, INVARIANTS kernel)

A demo PFIL_OUT hook (instr-ip6_input.c, compiled into test kernels — see "kld note" below) replaces the chain of one >5000-byte ::1 UDP6 packet that carries a 256-byte Hop-by-Hop option (root; options are privilege-gated) with a deep copy, frees the original, and returns 0.

The packet then fragments (lo0 MTU lowered to 1500). A/B/C results (run.log / run.2.log, tcpdump -X hex at offset 0x20 row = bytes 32..47; byte 40 = hbh byte 0):

The CONTROL run proves the rewrite code path executes and writes 44 when the cached pointers are still valid; the TEST run proves that after a legal chain replacement the same write lands outside the live packet — i.e. in the freed mbuf's target memory — while the live packet keeps nxt=17 and is emitted structurally corrupt. The FIXED kernel restores correctness even while the chain is being replaced.

(An additional in-hook attempt to reclaim the freed hbh cluster and plant a 0xAA canary read-proof is included in instr-ip6_input.c; on this guest the mbuf-cluster cache did not return the just-freed hbh cluster within the hook's window, so the canary probes were inconclusive — the wire-level A/B/C above is the decisive evidence.)

Threat model / severity

• The victim write is one byte (0x2c) at freed-cluster offset 0, plus a 1-byte stale read that becomes the wire protocol byte. Because freed clusters are immediately reusable by any network path, both are genuine UAF primitives into the mbuf cluster slab.
• Trigger gates: hbh/dest options require privilege at ip6_setpktoption (ip6_output.c:2763, :2794 — sticky options are EPERM even for root per DF-0313, but root CAN pass them per-packet as sendmsg cmsg), and a chain-replacing PFIL_OUT hook must be registered (pf-style normalization). Both are root/admin-side conditions, so this is not an unprivileged escalation; it is kernel self-corruption under firewalling.
• Observable packet corruption (every fragmented hbh packet becomes garbage on the wire) is the reliable impact; heap corruption is the theoretical ceiling.

Fix validation

fix.diff (applied to the guest's /usr/src copy only; the audit tree is read-only) replaces the stale-pointer cascade with ip6_lastunfignxt(), which re-locates the last unfragmentable next-header field in the current chain via m_getptr(), failing closed (EINVAL drop) on malformed headers.

• Baseline reproduced on stock-source kernel #5/#6 (uname in env.txt).
• Patched kernel #7: TEST run with chain replacement delivers the datagram, hbh.nxt = 0x2c on the wire. Bad behavior gone; no regressions in the control run.

kld note (why the hook is compiled-in)

kldload of ANY freshly-built module (kprintf-only test module, kmod.mk flags with/without KERNBUILDDIR, hand-linked variants) reliably panics this guest in strcmp (type 9 trap) during module registration, while stock /boot/kernel modules (if_tap.ko) load fine — the /usr/src snapshot does not match the running kernel's module ABI on this image. The demo hook was therefore compiled into instrumented kernels via make quickkernel, which boots and runs correctly (kernels #1..#7 built and tested during this session).

Kernel references

• sys/netinet6/ip6_output.c:164-173 (exthdrs fill), :249-282 (chaining), :658-663 (pfil_run_hooks — m may be replaced), :778-790 (stale read+write)
• sys/net/pfil.c:pfil_run_hooks (hook may replace *mp)
• sys/netinet6/raw_ip6.c:302, sys/netinet6/udp6_output.c:134 (cmsg privilege gate that makes the option root-only)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.