DF-3319 — v4 SIOCDLIFADDR kernel stack buffer overflow (in_lifaddr_ioctl)

Status: REPRODUCED (Fatal trap 12, control-flow corruption, guest wedged in DDB) + fix validated (patched kernel returns EADDRNOTAVAIL, guest stays up).

What

in_lifaddr_ioctl() (sys/netinet/in.c) — the AF_INET SIOCDLIFADDR path — copies ifaddr sockaddrs into a 64-byte on-stack struct in_aliasreq ifra using sin_len fields read out of the selected in_ifaddr as bcopy lengths:

bcopy(&ia->ia_addr,     &ifra.ifra_addr,    ia->ia_addr.sin_len);     /* :949 */
bcopy(&ia->ia_dstaddr,  &ifra.ifra_dstaddr, ia->ia_dstaddr.sin_len);  /* :952 */
bcopy(&ia->ia_sockmask, &ifra.ifra_dstaddr, ia->ia_sockmask.sin_len); /* :955 */

None of these lengths is validated, and the ia is selected by the DF-0490 type confusion (:911 filters != AF_INET6 in the IPv4 handler, :923 casts an in6_ifaddr to in_ifaddr). Under the confusion, ia_sockmask.sin_len reads in6_ifaddr offset 344 = ia_prefixmask.sin6_addr byte 12, which is 0xff for any IPv6 prefix length ≥ /104 — including the stock /128 of lo0's ::1 — producing a deterministic 255-byte bcopy into the 64-byte stack object (223 bytes past its end) that smashes the return path of in_lifaddr_ioctl() (running on the netisr0 dispatch thread, in.c:230-248).

DF-0490 claimed only the unprivileged read side (:927); this is the missed privileged write/stack-smash side of the same confusion, plus the DF-3318 twin persistence path (root can poison ia_dstaddr/ia_sockmask.sin_len directly via SIOCSIFDSTADDR/SIOCAIFADDR at :602/:668, which becomes the live route into :949-956 the moment the :911 filter is fixed without length validation).

How to reproduce

cc -O -o smash smash.c && cc -O -o getlif getlif.c   # build.sh
./getlif lo0     # stock kernel: garbage (type confusion visible)
./smash lo0      # as root; Fatal trap 12 within ~1s; guest wedges in DDB

The query address 0.248.255.255 is derived in smash.c: the walk's candidate expression (:915-916) reads through &ifa->ifa_addr — the address of the pointer field — so candidate is always the high 4 bytes of the kernel pointer (0xfffff800...) for every ifaddr; 00 f8 ff ff as network bytes is 0.248.255.255, matching the first AF_INET6 ifaddr on lo0 (::1, /128).

Expected (stock INVARIANTS kernel #0)

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xe4     (supervisor write data, page not present)
instruction pointer   = 0x8:0xfffff8004f308f46   <- heap address: smashed
frame pointer         = 0xfffff8004f308f28          return address jumped
current process       = Idle                        (netisr0 dispatch)
Stopped at -0x7ffb0cf70ba: addb %al,(%rax)          <- executing heap garbage

See panic.txt (serial console) — ssh dies; vm.sh status => down.

Fix validation (fix.diff, kernel #3 Thu Sep 10 19:51:37 UTC 2026)

The accidental observation on intermediate kernel #2 (clamps only, candidate hunk missing) is recorded in fix_run.log history: no panic, but the pointer-derived match still deleted 127.0.0.1 — evidence that the full fix (filter + candidate deref + clamps + set-side validation) is required.

DF-3319 VERDICT

Status: reproduced — privileged (SIOCDLIFADDR requires SYSCAP_RESTRICTEDROOT, in.c:437-441) deterministic kernel stack buffer overflow with control-flow corruption; fix validated on a rebuilt kernel.

The bug

Three bcopy calls in in_lifaddr_ioctl() (sys/netinet/in.c) use sin_len fields of the selected ifaddr as copy lengths into the 64-byte on-stack struct in_aliasreq ifra (:941-959), with no validation. The ifaddr is selected by the DF-0490 confusion (:911 != AF_INET6 in the IPv4 handler), so ia (:923) is really a struct in6_ifaddr:

• ia_sockmask.sin_len = in6_ifaddr offset 344 = ia_prefixmask.sin6_addr[12] → 0xff for every v6 prefix ≥ /104, lo0's stock ::1/128 included (in6_var.h:116 layout: ia_addr@240, ia_net@268, ia_dstaddr@296, ia_prefixmask@324).
• the resulting bcopy(&ia->ia_sockmask, &ifra.ifra_dstaddr, 255) writes 255 bytes at stack offset +32 of a 64-byte object — 223 bytes past its end, smashing the return path of in_lifaddr_ioctl(), which runs on netisr0 (in.c:230-248 dispatches SIOCDLIFADDR).

DF-0490's filed claim covers only the unprivileged read at :927. The stack-smash at :949-956 (and its DF-3318-twin persistence route: root poisons ia_dstaddr.sin_len via SIOCSIFDSTADDR :602 / ia_sockmask.sin_len via SIOCAIFADDR :668, reachable directly once :911 is corrected) is the residual this pass-2 finding captures.

Reproduction (stock INVARIANTS kernel #0, guest dfbsd 6.5-DEVELOPMENT)

• ./getlif lo0 (precheck.log): SIOCGLIFADDR returns family=0 len=0 addr=0.0.0.0 — the type confusion, live on a stock interface.
• ./smash lo0 as root: SIOCDLIFADDR with match address 0.248.255.255 (derived in smash.c from the :915-916 candidate expression, which reads through &ifa->ifa_addr, i.e. the high 4 bytes of the pointer — always 0xfffff800 on this guest). Result: Fatal trap 12, supervisor write data at 0xe4, instruction pointer = 0xfffff8004f308f46 (a kernel-heap address — the smashed return address contained a pointer from the bcopy source region), current process = Idle (netisr0 thread), CPU stopped executing heap garbage (addb %al,(%rax)), guest wedged in DDB, ssh dead (vm.sh status ⇒ down). See panic.txt.
• Two attempts total: the first used INADDR_ANY as the match (walk arithmetic then never matched → EADDRNOTAVAIL); after deriving the pointer-byte match, the panic is deterministic (it fires on the single ioctl; reproduced once per guest boot because the guest must be reset afterwards).

Why the impact ceiling is what it is

The trigger ioctl is privileged, so this is not an unpriv→root escalation by itself; it is kernel stack memory corruption with content sourced from the in6_ifaddr tail plus adjacent slab (groomable by the same privileged user), deterministic control-flow destruction (RIP observed executing a heap pointer), and a hard DoS (wedged DDB). The unprivileged side of the same confusion remains DF-0490's :927 leak. Fixing DF-0490's filter alone would activate the DF-3318-twin route (poisoned v4 sin_len → these same stack bcopies), which is why the fix below validates lengths as well.

Fix validation

fix.diff (git-apply-able against sys/netinet/in.c) contains:

1. :911 filter AF_INET6 → AF_INET (the DF-0490 typo — needed so the v4 handler stops feeding in6_ifaddr objects into these bcopies and so v4 SIOC[GD]LIFADDR work at all);
2. :915-916 candidate (struct sockaddr_in *)&ifa->ifa_addr → deref the sockaddr (second half of the same botched copy; without it the walk matches every ifaddr by pointer bytes and deletes wrong addresses);
3. consume-side clamps (alen/dlen/mlen ≤ sizeof(struct sockaddr_in)) at :927/:930/:949/:952/:955 — defense in depth for any garbage/poisoned sin_len in a live ifaddr;
4. set-side validation: SIOCAIFADDR (addr/mask/dstaddr/broadaddr), SIOCSIFDSTADDR, SIOCSIFBRDADDR reject sin_len > sizeof(struct sockaddr_in) before persisting; in_ifinit() rejects oversized sin->sin_len (kills the DF-3320 persistence at :998).

Built in-guest (make -j4 nativekernel KERNCONF=X86_64_GENERIC, 0 warnings), installed, rebooted into kernel #3 (Thu Sep 10 19:51:37 UTC 2026):

• baseline (stock #0): smash ⇒ Fatal trap 12 / DDB wedge (panic.txt).
• patched (#3): smash ⇒ EADDRNOTAVAIL, lo0 keeps 127.0.0.1 (no bogus delete), guest stays up; ./getlif lo0 ⇒ 127.0.0.1 len=16 /8 (v4 SIOCGLIFADDR now functional — regression proof); normal alias add/remove works (fix_run.log).
• intermediate kernel #2 (clamps present, candidate hunk missing due to a patch-application slip, documented): no panic, but the pointer-byte match deleted 127.0.0.1 — demonstrating the clamps alone are insufficient for correct behavior and motivating hunks 1-2.

Lines cited

• sys/netinet/in.c:911 — AF_INET6 filter in IPv4 handler (DF-0490)
• sys/netinet/in.c:915-916 — candidate read through &ifa->ifa_addr
• sys/netinet/in.c:923 — in6_ifaddr cast to in_ifaddr
• sys/netinet/in.c:941-959 — on-stack in_aliasreq ifra + unvalidated bcopy lengths (:949-950, :952-953, :955-956)
• sys/netinet/in.c:230-248 — SIOCDLIFADDR dispatch to netisr0
• sys/netinet/in.c:437-441 — privilege gate (privileged trigger)
• sys/netinet/in.c:602, :668 — privileged sin_len persistence (twin route)
• sys/netinet6/in6_var.h:116-132 — in6_ifaddr layout (offset arithmetic)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.