⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-3329

verify_mesh_preq_len/verify_mesh_perr_len/verify_mesh_prep_len read IE fields beyond the end of the frame before validating the declared IE length

Summary

The HWMP IE verify helpers read fixed offsets of the IE (flags at iefrm[2], target-count at iefrm[27|33], ndest at iefrm[3]) and walk per-destination flag bytes (up to ~365 bytes) having only the caller's guarantee that iefrm[0..iefrm[1]+1] are in-frame. A trailing PREQ/PERR IE declaring a short len makes the kernel read tens to hundreds of bytes past efrm into adjacent mbuf-cluster/slab memory before the alloc_sz != iefrm[1] discard fires. DF-3290 (GANN) class, but the read values never propagate to the wire here - no leak, theoretical fault only. Hardening-class Low, by-inspection. Fix: pass the remaining length into the verify helpers and bound every read (check iefrm[1] >= minimal base before reading; stop the per-dest walk at iefrm + iefrm[1] + 2). [VERIFIED pass2: reproduced via guard harness - PREQ reads target count before checking iefrm 1, PERR walks destinations unbounded, three OOB cases fault; bounds fix A/B]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3329 · 13 files
FileTypeDescriptionSize
README.md — 762 B ↓ raw
VERDICT.md — 2.1 KB ↓ raw
allruns.log — 4.9 KB view raw
build.sh — 708 B view raw
df3329.c — 3.5 KB view raw
fix.diff — 632 B view raw
fixbuild.sh — 394 B view raw
fixrun.sh — 1.1 KB view raw
fixruns.log — 810 B view raw
guard.h — 1.3 KB view raw
manifest.json — 850 B view raw
run.sh — 2.0 KB view raw
verdict.json — 1.5 KB view raw
README.md
↓ download raw

DF-3329 -- verification pack

Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest) Status: REPRODUCED | impact: none | confidence: certain

What this is

verify_mesh_preq_len/verify_mesh_perr_len read iefrm[2]/iefrm[27|33]/iefrm[3] and walk PERR destinations BEFORE and BEYOND the declared IE length (three OOB cases). Verbatim harness faults the guard page on all three.

Build

./build.sh

Run

df3329 1

(success criterion: see VERDICT.md)

Evidence

cases 1-3 rc=139 (preq iefrm[33]; perr iefrm[3]; perr dest-flag walk); control (full IE) rc=0; FIXED bound clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_hwmp.c:317-386, sys/netproto/802_11/ieee80211_mesh.h:229-285

VERDICT.md
↓ download raw

DF-3329 -- VERDICT

REPRODUCED (impact=none, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Summary

verify_mesh_preq_len/verify_mesh_perr_len read iefrm[2]/iefrm[27|33]/iefrm[3] and walk PERR destinations BEFORE and BEYOND the declared IE length (three OOB cases). Verbatim harness faults the guard page on all three.

How it was verified

  • Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
  • Kernel references: sys/netproto/802_11/wlan/ieee80211_hwmp.c:317-386, sys/netproto/802_11/ieee80211_mesh.h:229-285
  • Evidence: cases 1-3 rc=139 (preq iefrm[33]; perr iefrm[3]; perr dest-flag walk); control (full IE) rc=0; FIXED bound clean
  • Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
  • Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).

Fix

fix_status: fixed -- Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items. fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items.

↓ fix.diffper-fix-DF-3329

Confirmed kernel references

Detail

Evidence (decisive lines)

cases 1-3 rc=139 (preq iefrm[33]; perr iefrm[3]; perr dest-flag walk); control (full IE) rc=0; FIXED bound clean

Verified recommended fix

fix.diff

Verdict

verify_mesh_preq_len/verify_mesh_perr_len read iefrm[2]/iefrm[27|33]/iefrm[3] and walk PERR destinations BEFORE and BEYOND the declared IE length (three OOB cases). Verbatim harness faults the guard page on all three.