DF-3355 — red_drops divides by fs->lookup_step taken verbatim from config: lookup_step==0 -> kernel divide-by-zero panic (DF-0375 family in v3)

File: sys/net/dummynet3/ip_dummynet3.c (pass 2) Severity: Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) — CWE-369 Divide By Zero Verdict: reproduced (panic) on stock INVARIANTS guest, see verdict.json.

Build

copy dfv3.c + setup.sh to the guest, then (root): cc -O -o /tmp/dfv3 /tmp/dfv3.c

Run

sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
/tmp/dfv3 redzero

Expected

kernel panic signature in serial console (see panic.txt)

setup.sh sets net.filters_default_to_accept=1 BEFORE kldload ipfw3 — ipfw3 otherwise boots default-deny and locks out ssh.

Fix

fix.diff (union patch for DF-3352..DF-3356; the hunk for THIS finding is: sanitize lookup_step<1 to 1 in config_red (fix.diff hunk 5)).

DF-3355 VERDICT — reproduced

Root cause

config_red() copies ioc_fs->lookup_step into the flowset without any validation (ip_dummynet3.c:1374). When a RED flowset with lookup_step==0 has a flow queue that goes idle with a non-zero average and then receives one more packet, red_drops() executes u_int t = (curr_time - q->q_time) / fs->lookup_step (:904) -> integer divide fault. Reproduced 1/1 on the stock guest: 'Fatal trap 18: integer divide fault', Stopped at dummynet_io+0x8c2: divq %rsi,%eax (red_drops is inlined into dummynet_io); the only #DE-capable division reachable in that function under this config is the lookup_step one (fs weight is 1). Trigger: RED fs (w_q=65536 so avg jumps to SCALE(1) on the 2nd packet), 3 packets to build avg>0, wait for the queue to empty, one more packet. Identical code to v1 DF-0375 (sys/net/dummynet/ip_dummynet.c); missed by pass-1 of this file (DF-0382 only covers config_red's own max_th/(max_th-min_th) divisions).

Exploit chain

root: setsockopt pipe{slow} + fs{DN_IS_RED, w_q=65536, lookup_step=0, mask dst-port}; 3 quick UDP pkts to one flow (3rd sees q_size!=0 -> avg>0), 1 pkt to a second flow (keeps scheduler busy so the idle-flush at :614 cannot mark/expire the victim queue), wait 200ms, 1 more pkt to the first flow -> red_drops q_size==0 && avg!=0 branch -> divq by zero -> panic. No uid=0.

Evidence

• panic.txt: Fatal trap 18 integer divide fault, dummynet_io+0x8c2 divq %rsi,%eax
• run.log: RED config + 5-packet choreography transcript
• dfv3.c: redzero subcommand

Kernel refs

• sys/net/dummynet3/ip_dummynet3.c:1374
• sys/net/dummynet3/ip_dummynet3.c:904
• sys/net/dummynet3/ip_dummynet3.c:1108

Fix validation

fix.diff hunk: sanitize lookup_step<1 to 1 in config_red (fix.diff hunk 5). See verdict.json fix_* fields — a single guest kernel rebuilt with the union fix.diff (all five findings) was re-tested with the exact same PoCs: baseline panic/growth reproduced on the stock kernel, patched kernel rejects or sanitizes the bad configs and shows none of the five defects (details in fix section of verdict.json).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.