DF-3309

ip6_getmoptions(): IPV6_MULTICAST_LOOP default echoes the hop-limit default instead of the loop default

Summary

The IPV6_MULTICAST_LOOP GET branch returns *loop = ip6_defmcasthlim when no options are attached, instead of IPV6_DEFAULT_MULTICAST_LOOP (copy-paste from the HOPS branch). The two sysctl-tunable defaults diverge whenever net.inet6.ip6.defmcasthlim != 1, making getsockopt(IPV6_MULTICAST_LOOP) report a loop setting the socket does not have. API correctness only (values coincide under default sysctls); trivial repro (sysctl defmcasthlim=5 then getsockopt returns 5). Fix: one-constant substitution. [VERIFIED pass2: reproduced - defmcasthlim 5 makes IPV6_MULTICAST_LOOP return 5 via copy-paste; F40FIX returns 1]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — network stack
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-682
File: sys/netinet6/ip6_output.c
Lines: 2511-2515
Area: net
Discovered: 2026-09-10
Updated: 2026-09-10

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:04
Attempts: 1
Runtime: 15s
Code hash: 2850c0e1a8128c31
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:05
Runtime: —
Kernel: per-fix-DF-3309
fix.diff: findings/poc/DF-3309/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3309 · 6 files

File	Type	Size
README.md	—	221 B	↓ raw
df3309.c	—	702 B	view raw
fix.diff	—	375 B	view raw
manifest.json	—	379 B	view raw
run.log	—	496 B	view raw
verdict.json	—	1.4 KB	view raw

README.md

↓ download raw

DF-3309 evidence pack

What

IPV6_MULTICAST_LOOP GET echoes the hop-limit default

Verdict

status=reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

fixed

A/B complete: with defmcasthlim=5 the fixed kernel returns IPV6_MULTICAST_LOOP=1 (stock returned 5).

↓ fix.diffper-fix-DF-3309

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - first probe already correct

Verified recommended fix

return IPV6_DEFAULT_MULTICAST_LOOP instead of ip6_defmcasthlim

Verdict

Reproduced on the stock INVARIANTS guest: after sysctl -w net.inet6.ip6.defmcasthlim=5, getsockopt(IPV6_MULTICAST_LOOP) on a fresh socket (no multicast options attached) returns 5; with the default sysctl it returns 1. The GET branch copies ip6_defmcasthlim instead of IPV6_DEFAULT_MULTICAST_LOOP (ip6_output.c:2511-2515) - copy-paste from the HOPS branch two cases above. API correctness only. Post-fix A/B on the F40FIX kernel: with defmcasthlim=5 the same getsockopt returns 1.