Pre-dispatch rx-sequence check reads i_seq/i_qos past short TODS/DSTODS frames (>=24-byte length only enforced for the NODS path)
Summary
hostap_input() only enforces m_pkthdr.len >= sizeof(struct ieee80211_frame) on the NODS-mgt/data branch that reads i_addr3. For dir == TODS/DSTODS the bssid comes from i_addr1 and the >=24 check is skipped, yet IEEE80211_HAS_SEQ() is true for all mgmt and (non-QoS-null) data frames, so ieee80211_gettid() reads i_qos (offsets 24-25, or 30-31 for 4-addr QoS) and ieee80211_check_rxseq() reads i_seq (22-23) on frames as short as 10 bytes - up to 6+ bytes past the logical frame end. Reads stay inside the mbuf data slab in practice (no fault, no disclosure; values only feed dedup) - same defense-in-depth family as DF-0348 (contiguity) and DF-3313 (BAR length), but a distinct length-check gap on this dispatch path. Fix: hoist the length check (+ m_pullup, closing DF-0348 too) for ALL non-CTL frames before the bssid/sequence block. [VERIFIED pass2: reproduced via guard harness - 10-byte TODS QoS frames reach gettid check_rxseq reading bytes 22-25 stale; header-gate fix A/B]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3325 · 13 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 805 B | ↓ raw | |
| VERDICT.md | — | 2.1 KB | ↓ raw | |
| allruns.log | — | 4.9 KB | view raw | |
| build.sh | — | 708 B | view raw | |
| dfpredispatch.c | — | 4.5 KB | view raw | |
| fix.diff | — | 574 B | view raw | |
| fixbuild.sh | — | 394 B | view raw | |
| fixrun.sh | — | 1.1 KB | view raw | |
| fixruns.log | — | 810 B | view raw | |
| guard.h | — | 1.3 KB | view raw | |
| manifest.json | — | 825 B | view raw | |
| run.sh | — | 2.0 KB | view raw | |
| verdict.json | — | 1.5 KB | view raw |
DF-3325 -- verification pack
Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest) Status: REPRODUCED | impact: none | confidence: certain
What this is
hostap_input pre-dispatch rx-sequence block reads i_seq (offset 22) and i_qos (offset 24) of TODS/DSTODS frames with only the 10-byte frame_ack minimum guaranteed (the >=24-byte check guards only the NODS bssid path). Verbatim harness with a 10-byte TODS QoS data frame faults the guard page.
Build
./build.sh
Run
df3325 oob
(success criterion: see VERDICT.md)
Evidence
control (30-byte frame) rc=0; 10-byte frame rc=139; FIXED length gate clean
Kernel references: sys/netproto/802_11/wlan/ieee80211_hostap.c:551-590, sys/netproto/802_11/ieee80211_proto.h:337-350
DF-3325 -- VERDICT
REPRODUCED (impact=none, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Summary
hostap_input pre-dispatch rx-sequence block reads i_seq (offset 22) and i_qos (offset 24) of TODS/DSTODS frames with only the 10-byte frame_ack minimum guaranteed (the >=24-byte check guards only the NODS bssid path). Verbatim harness with a 10-byte TODS QoS data frame faults the guard page.
How it was verified
- Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
- Kernel references: sys/netproto/802_11/wlan/ieee80211_hostap.c:551-590, sys/netproto/802_11/ieee80211_proto.h:337-350
- Evidence: control (30-byte frame) rc=0; 10-byte frame rc=139; FIXED length gate clean
- Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
- Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).
Fix
fix_status: fixed -- Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items. fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
fixedHarness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items.
Confirmed kernel references
Detail
Evidence (decisive lines)
control (30-byte frame) rc=0; 10-byte frame rc=139; FIXED length gate clean
Verified recommended fix
fix.diff
Verdict
hostap_input pre-dispatch rx-sequence block reads i_seq (offset 22) and i_qos (offset 24) of TODS/DSTODS frames with only the 10-byte frame_ack minimum guaranteed (the >=24-byte check guards only the NODS bssid path). Verbatim harness with a 10-byte TODS QoS data frame faults the guard page.
No comments yet.