DF-3352 — negative flowset weight reaches p->sum==0 -> integer divide-by-zero panic in ready_event_wfq

File: sys/net/dummynet3/ip_dummynet3.c (pass 2) Severity: Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) — CWE-369 Divide By Zero Verdict: reproduced (panic) on stock INVARIANTS guest, see verdict.json.

Build

copy dfv3.c + setup.sh to the guest, then (root): cc -O -o /tmp/dfv3 /tmp/dfv3.c

Run

sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
/tmp/dfv3 negweight

Expected

kernel panic signature in serial console (see panic.txt)

setup.sh sets net.filters_default_to_accept=1 BEFORE kldload ipfw3 — ipfw3 otherwise boots default-deny and locks out ssh.

Fix

fix.diff (union patch for DF-3352..DF-3356; the hunk for THIS finding is: clamp weight <=0 to 1 at flowset creation (fix.diff hunk 3)).

DF-3352 VERDICT — reproduced

Root cause

config_pipe() clamps flowset weight only against 0 and >100 (ip_dummynet3.c:1547-1551); a negative weight (e.g. -1) is stored verbatim in the flowset. dummynet_io() then does pipe->sum += fs->weight (:1150), so one flow on a weight=+1 flowset and one flow on a weight=-1 flowset of the same pipe drive pipe->sum to exactly 0 while a packet of the second flow sits in scheduler_heap. When the WF2Q credit timer fires, ready_event_wfq() moves that packet and executes p->V += (len << MY_M) / p->sum (:574) with sum==0 -> integer divide fault. Reproduced 1/1 on the stock INVARIANTS guest: Fatal trap 18 'integer divide fault', Stopped at ready_event_wfq+0xd1: divq %rcx,%eax, current process Idle (netisr drain on cpu0), CPU0 stopped. Deterministic, ~12ms after the second trigger packet. Root-configured (raw-socket setsockopt IP_DUMMYNET_CONFIGURE behind SYSCAP_NONET_RAW), so local privileged DoS; same validation gap also lets sum go negative (V stalls, WF2Q eligibility corrupted). v1 twin file has the identical bug; it was missed by both pass-1 audits.

Exploit chain

root: setsockopt pipe{bw=1Mbit} + fs{w=+1} + fs{w=-1} on one pipe; 2 UDP packets via lo0 ipfw3 queue rules (different dst-ports -> different flowsets/flows); first flow sum=1, second flow sum=0; next wfq_ready_heap fire -> divq by zero -> kernel panic. No uid=0: divide-fault crash primitive only.

Evidence

• panic.txt: Fatal trap 18 integer divide fault, Stopped at ready_event_wfq+0xd1 divq %rcx,%eax
• run.log: full setup+trigger transcript (panic ~12ms after 2nd packet)
• dfv3.c: negweight subcommand (raw setsockopt structs verbatim from ip_dummynet3.h)

Kernel refs

• sys/net/dummynet3/ip_dummynet3.c:1547
• sys/net/dummynet3/ip_dummynet3.c:1150
• sys/net/dummynet3/ip_dummynet3.c:574
• sys/net/dummynet3/ip_dummynet3.c:1182

Fix validation

fix.diff hunk: clamp weight <=0 to 1 at flowset creation (fix.diff hunk 3). See verdict.json fix_* fields — a single guest kernel rebuilt with the union fix.diff (all five findings) was re-tested with the exact same PoCs: baseline panic/growth reproduced on the stock kernel, patched kernel rejects or sanitizes the bad configs and shows none of the five defects (details in fix section of verdict.json).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.