DF-3340 — pf synproxy PROXY:DST purge sends TCP RST from non-netisr context → guaranteed INVARIANTS panic (remotely triggerable)

What

pf_unlink_state() (sys/net/pf/pf.c:1483) emits a spoofed TCP RST via pf_send_tcp() → ip_output() (sys/net/pf/pf.c:2255) whenever a pf state is unlinked while its source peer is stuck in PF_TCPS_PROXY_DST — i.e. a synproxy state rule where the client completed the handshake with the firewall itself but the backend never answered SYNACK.

ip_output() asserts at entry ASSERT_NETISR_NCPUS(mycpuid) (sys/netinet/ip_output.c:185, macro at sys/net/netisr2.h:136-139) that the caller is a netisr thread. Four unlink contexts are not netisr threads:

Reproduce (guest, root)

1. sh findings/poc/DF-3340/trigger.sh (pushed to guest): loads stock pf.ko, installs set timeout tcp.first 5 + pass in quick on lo0 inet proto tcp from 127.0.0.0/8 to 127.0.0.1 port 8080 flags S/SA synproxy state, then one nc 127.0.0.1 8080.
2. nc's SYN creates the state (PROXY_SRC), PF answers SYNACK itself; the client ACK completes the handshake with the firewall (PROXY_DST, pf.c:4935) and PF sends a spoofed SYN at the backend (pf.c:4948). Nothing listens on 8080 → the stack's RST is dropped by the PROXY_DST check (pf.c:4955-4959) → state sticks in PROXY:DST (pfctl -s state shows it).
3. ~5 s later (tcp.first; 120 s at default timeout, pf_ioctl.c:267) the purge thread unlinks the state → RST send → panic.

Expected output (baseline)

--- states at t+2s (expect SYN_PROXY / PROXY:DST):
all tcp 127.0.0.1:8080 <- 127.0.0.1:1309       PROXY:DST
[ssh dies ~5-7 s after the connect]

serial console (panic.txt):

panic: thread 0xfffff800905f5f80 cpu2 is not within netisr_ncpus 6
ip_output() at ip_output+0x64e
ip_output() at ip_output+0x64e
pf_send_tcp() at pf_send_tcp+0x4f3
pf_unlink_state() at pf_unlink_state+0xc6
pf_purge_expired_states() at pf_purge_expired_states+0x89
pf_purge_thread() at pf_purge_thread+0xb4
Debugger("panic")

Remote analogue

On a real edge firewall the same two packets (SYN, then handshake-completing ACK) from any unauthenticated host to any synproxy-protected port whose backend is down/filtered create the same stuck PROXY:DST state; the panic fires on the next purge pass after tcp.first (default 120 s). Loopback is used in the rig only because the QEMU guest has one interface.

Fix validation (fix.diff)

fix.diff defers the RST to a netisr via a heap netmsg (rtfree_async pattern, sys/net/route.c:311-338) with all parameters copied (state and rule are freed before dispatch), keeps a direct-send fast path when already on a netisr thread (packet path, pf.c:5006), and drains in-flight netmsgs in pf_unload() so the module can't be freed under a queued netmsg.

Patched pf.ko (built in-guest, -Werror clean):

• expiry trigger: SURVIVED, state purged, and the deferred spoofed RST still leaves the box — tcpdump on lo0: 03:50:14.023682 IP 127.0.0.1.8080 > 127.0.0.1.1485: Flags [R.], seq 0, ack 1 exactly 4.7 s after the connect (= tcp.first 5 s + purge cadence).
• kldunload pf with a live PROXY:DST state (DF-3337's context): clean.
• 8-state stress run: survived, all states purged, serial console clean.

Severity honesty

• The panic is guaranteed on INVARIANTS kernels — and the stock default config ships INVARIANTS (options INVARIANTS, sys/config/X86_64_GENERIC:56); this audit's reference kernel (uname: .../usr/obj/usr/src/sys/X86_64_GENERIC) is exactly that build. Default-config DragonFly + a synproxy rule = remotely triggerable unauthenticated panic after tcp.first (default 120 s).
• Kernels custom-built without INVARIANTS compile the assert out; the send then runs on the purge thread — an architecture violation (network output outside netisr serialization, pf_consistency_lock held exclusively, can sleep inside ip_output's route path) — but no non-INVARIANTS crash was demonstrated. No memory-corruption primitive; not a uid0 path.

DF-3340 VERDICT

Status: reproduced (panic, remote-unauthenticated trigger class) — fix validated (fixed). Impact: panic/DoS — guaranteed on INVARIANTS kernels only; not a memory-corruption/uid0 primitive.

Root cause (line-accurate)

1. A synproxy state rule makes pf terminate the TCP handshake with the client itself: on the client SYN, pf_create_state() sets src.state = PF_TCPS_PROXY_SRC (pf.c:4268) and answers SYNACK (pf.c:4292). State timeout is PFTM_TCP_FIRST_PACKET (pf.c:4188), expire = creation (pf.c:4208).
2. The client ACK completes the handshake with the firewall: src.state = PF_TCPS_PROXY_DST (pf.c:4935); pf sends a spoofed SYN at the backend (pf.c:4948). Every SYNPROXY path then FAILs, so the timeout / expire refresh code at pf.c:4829-4846 is never reached.
3. If the backend never SYNACKs (down / filtered / RSTs — an RST is dropped by the reverse-direction check at pf.c:4955-4959), the state is stuck in PROXY:DST until it ages out: expire + tcp.first (default 120 s, pf_ioctl.c:267).
4. The 1 Hz pf_purge_thread (pf.c:1262) — a plain kernel thread whose td_msgport is not a netisr port — unlinks the expired state: pf_purge_expired_states (pf.c:1591) → pf_unlink_state (pf.c:1483).
5. pf_unlink_state sees PF_TCPS_PROXY_DST and calls pf_send_tcp() with TH_RST|TH_ACK (pf.c:1487-1496) to spoof a RST from the backend to the client; pf_send_tcp calls ip_output(m, NULL, NULL, 0, NULL, NULL) directly (pf.c:2255).
6. ip_output() asserts at entry ASSERT_NETISR_NCPUS(mycpuid) (ip_output.c:185; macro netisr2.h:136-139) → panic: thread %p cpu%d is not within netisr_ncpus %d. KASSERT/KKASSERT are compiled only with options INVARIANTS (sys/sys/systm.h:95 ff.).

Same send, root-only contexts: DIOCCLRSTATES pf_ioctl.c:1591, DIOCKILLSTATES pf_ioctl.c:1621/1676, module unload (pf_unload → shutdown_pf pf_ioctl.c:3187 → pf_clear_states pf_ioctl.c:3071) — the last one is the panic observed incidentally during the DF-3337 run (findings/poc/DF-3337/panic_unload_incidental.txt).

Reproduction (this run, guest X86_64_GENERIC #0 Thu Jul 2 2026, INVARIANTS, 6 CPUs)

trigger.sh: pf on lo0, tcp.first 5, synproxy rule on 127.0.0.1:8080 (no listener), one nc 127.0.0.1 8080.

• t+2 s: pfctl -s state → all tcp 127.0.0.1:8080 <- 127.0.0.1:1309 PROXY:DST
• t≈+6 s: ssh dies; serial console (panic.txt): panic: thread 0xfffff800905f5f80 cpu2 is not within netisr_ncpus 6 with ip_output ← ip_output ← pf_send_tcp ← pf_unlink_state ← pf_purge_expired_states ← pf_purge_thread — the purge-thread expiry backtrace, distinct from and complementary to DF-3337's unload backtrace. This is the remotely-triggerable variant.

Remote analogue: two packets (SYN + handshake-completing ACK) from any unauthenticated host against any synproxy-protected port with a dead backend; panic on the next purge pass after tcp.first (120 s default). synproxy is a mainstream edge-firewall configuration (DDoS protection), and "backend down" is the exact situation it exists for, so exposure is realistic wherever INVARIANTS kernels are deployed.

Why not worse (honest ceiling)

• The trap is an INVARIANTS assert — and the stock default config ships it: options INVARIANTS at sys/config/X86_64_GENERIC:56. The reference guest boots exactly that config, so a default nativekernel build is a remotely-triggerable, unauthenticated, guaranteed panic. (Kernels custom built without INVARIANTS compile the assert out; there the send executes on the purge thread — an architecture violation with no demonstrated crash.)
• No attacker-controlled data reaches the packet beyond addr/port/seqs pf itself generated → no memory-corruption primitive, no uid0 chain. (Assessed against the escalation objective; this is a pure DoS.)

Fix (fix.diff) and validation

Defer the RST to a netisr via heap netmsg — the established rtfree_async pattern (sys/net/route.c:311-338):

• struct pf_synproxy_rst netmsg copies everything pf_send_tcp needs (af, addrs, ports, seq/ack, tag, rtableid, ALTQ qid/ecn_af) — the state and rule are freed before dispatch, so no pointer survives.
• Fast path preserved: when already on a netisr thread (packet path, pf.c:5006) the original direct send is kept.
• pf_synproxy_rst_drain() in pf_unload() (pf_ioctl.c:3394) waits (bounded, 10 × 100 ms) for in-flight netmsgs so the module is never freed under a queued netmsg referencing module text.

Validation on the same guest, patched pf.ko built in-guest (-Werror clean, fix_build.log):

1. Expiry trigger re-run (fixcheck.sh): SURVIVED; state purged; the deferred spoofed RST still leaves the host — tcpdump on lo0: 03:50:14.023682 IP 127.0.0.1.8080 > 127.0.0.1.1485: Flags [R.], seq 0, ack 1 4.7 s after the connect (= 5 s tcp.first + purge cadence). Baseline panicked at exactly this point.
2. Unload with live PROXY:DST state (DF-3337's context): clean unload, pf fully unloaded (fix_unload_stress.log).
3. 8-state stress: survived, 0 remaining states, dmesg/serial clean.

Baseline vs patched, same kernel, same rig, same module build path — the only delta is fix.diff.

Files

• trigger.sh — baseline panic rig (stock pf.ko)
• panic.txt, run.log, serial_boot_full.log — baseline evidence
• fix.diff — validated fix (pf.c + pf_ioctl.c + pfvar.h)
• fixcheck.sh, fix_run.log, fix_unload_stress.log, fix_build.log — fix validation
• env.txt — guest identity

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.