DF-3342

[CROSS-FILE: ieee80211_sta.c] sta_input pre-dispatch block reads i_addr2/i_seq/i_qos with only frame_min guaranteed — unfiled mirror of DF-3325

Summary

CROSS-FILE finding (root cause in ieee80211_sta.c:601/:642-652; filed under this run's reserved IDs). sta_input validates only m_pkthdr.len >= 10 (frame_min) yet then reads wh->i_addr2 (offsets 10-15) for the BSSID match, and in the HAS_SEQ block calls ieee80211_gettid (reads i_qos, offsets 24/26) and check_rxseq (reads i_seq, offset 22) - all before any m_pullup and with no check of the first mbuf's m_len. Pass 1 filed exactly this defect only for the hostap variant (DF-3325/DF-0325 note); the sta variant went unfiled. Adjacent attacker via crafted short QoS/TODS frames (or a driver delivering non-contiguous first mbufs): OOB read of <=6 bytes (addr2) / <=4 bytes (seq/qos). Effect: garbage BSSID/TID/rx-seq compare - frame drop or wrong-AC accounting; no corruption, no attacker-visible disclosure. Phase V skipped (Low). Fix: pull up the full 802.11 header before the pre-dispatch reads. [VERIFIED pass2: reproduced via guard harness - sta mirror of DF-3325 faults on the 10-byte TODS QoS frame; header-gate fix A/B]

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: likely
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-125
File: sys/netproto/802_11/wlan/ieee80211_proto.c
Lines: 601-652
Area: net
Discovered: 2026-09-11
Updated: 2026-09-11

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: none
Confidence: certain
Tested: 2026-10-25 18:19:37
Attempts: 3
Runtime: 60s
Code hash: af9f6688876b600d
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: ./build.sh
Run cmd: df3342h oob

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-10-25 18:19:38
Runtime: —
Kernel: per-fix-DF-3342
fix.diff: findings/poc/DF-3342/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3342 · 13 files

File	Type	Size
README.md	—	633 B	↓ raw
VERDICT.md	—	1.9 KB	↓ raw
allruns.log	—	4.9 KB	view raw
build.sh	—	708 B	view raw
dfpredispatch.c	—	4.5 KB	view raw
fix.diff	—	538 B	view raw
fixbuild.sh	—	394 B	view raw
fixrun.sh	—	1.1 KB	view raw
fixruns.log	—	810 B	view raw
guard.h	—	1.3 KB	view raw
manifest.json	—	800 B	view raw
run.sh	—	2.0 KB	view raw
verdict.json	—	1.4 KB	view raw

README.md

↓ download raw

DF-3342 -- verification pack

Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest) Status: REPRODUCED | impact: none | confidence: certain

What this is

sta_input pre-dispatch mirror of DF-3325: gettid()/check_rxseq read i_qos/i_seq past short non-NODS frames. Same verbatim harness compiled -DSTA.

Build

./build.sh

Run

df3342h oob

(success criterion: see VERDICT.md)

Evidence

identical to DF-3325 (df3342h binary in allruns.log)

Kernel references: sys/netproto/802_11/wlan/ieee80211_sta.c:620-650, sys/netproto/802_11/ieee80211_proto.h:337-350

VERDICT.md

↓ download raw

DF-3342 -- VERDICT

REPRODUCED (impact=none, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Summary

sta_input pre-dispatch mirror of DF-3325: gettid()/check_rxseq read i_qos/i_seq past short non-NODS frames. Same verbatim harness compiled -DSTA.

How it was verified

Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
Kernel references: sys/netproto/802_11/wlan/ieee80211_sta.c:620-650, sys/netproto/802_11/ieee80211_proto.h:337-350
Evidence: identical to DF-3325 (df3342h binary in allruns.log)
Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).

Fix

fix_status: fixed -- Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items. fix.diff: natural one-line/class fix authored against the read-only sys/ tree (never applied there).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

Harness A/B (fixruns.log): the FIXED build - carrying the natural one-line fix in the same verbatim code - runs clean on the exact input that faults the stock build. Kernel not rebuilt for these Low/hardening items.

↓ fix.diffper-fix-DF-3342

Confirmed kernel references

Detail

Evidence (decisive lines)

identical to DF-3325 (df3342h binary in allruns.log)

Verified recommended fix

fix.diff

Verdict

sta_input pre-dispatch mirror of DF-3325: gettid()/check_rxseq read i_qos/i_seq past short non-NODS frames. Same verbatim harness compiled -DSTA.