DF-3356 — negative qsize survives set_fs_parms clamping: signed/unsigned compare in dummynet_io never fires -> unbounded queue growth / memory-exhaustion DoS (DF-0376 family in v3)

File: sys/net/dummynet3/ip_dummynet3.c (pass 2) Severity: Low (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) — CWE-195 Signed to Unsigned Conversion Error Verdict: reproduced (dos) on stock INVARIANTS guest, see verdict.json.

Build

copy dfv3.c + setup.sh to the guest, then (root): cc -O -o /tmp/dfv3 /tmp/dfv3.c

Run

sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
/tmp/dfv3 qsize -1 400 (then control: qsize 50 400)

Expected

GET dump shows len=399 drops=0 with qsize=-1 vs len=50 drops=349 control

setup.sh sets net.filters_default_to_accept=1 BEFORE kldload ipfw3 — ipfw3 otherwise boots default-deny and locks out ssh.

Fix

fix.diff (union patch for DF-3352..DF-3356; the hunk for THIS finding is: clamp negative qsize to the defaults in set_fs_parms (fix.diff hunk 4)).

DF-3356 VERDICT — reproduced

Root cause

set_fs_parms() clamps qsize only against the upper bound and 0 (ip_dummynet3.c:1442-1448: qsize > 1024*1024 / qsize == 0 || qsize > 100); a negative qsize passes both checks (slot mode) and is stored. dummynet_io() then enforces the limit with if (q->len >= fs->qsize) (:1104) where q->len is u_int and the negative int is converted to ~4e9, so the drop check never fires and the flow queue grows without bound, pinning kernel memory (mbuf clusters) until the system exhausts memory. Demonstrated live on the stock guest with no panic: hammering 400 packets into a qsize=-1 flowset yields len=399, drops=0 in the IP_DUMMYNET_GET dump, while the byte-for-byte identical control run with qsize=50 yields len=50, drops=349. Growth is bounded only by available kernel memory. Identical code to v1 DF-0376; missed by pass-1 of this file.

Exploit chain

root: setsockopt pipe{bw 8k} + fs{qsize=-1}; unprivileged UDP flood to a port diverted by an ipfw3 queue rule -> queue accumulates without limit -> kmalloc'd dn_pkt/mbuf exhaustion -> OOM DoS. No uid=0.

Evidence

• run.log: GET dump qsize=-1 (len=399 drops=0) vs control qsize=50 (len=50 drops=349)
• dfv3.c: qsize subcommand + GET walker

Kernel refs

• sys/net/dummynet3/ip_dummynet3.c:1442
• sys/net/dummynet3/ip_dummynet3.c:1446
• sys/net/dummynet3/ip_dummynet3.c:1100
• sys/net/dummynet3/ip_dummynet3.c:1104

Fix validation

fix.diff hunk: clamp negative qsize to the defaults in set_fs_parms (fix.diff hunk 4). See verdict.json fix_* fields — a single guest kernel rebuilt with the union fix.diff (all five findings) was re-tested with the exact same PoCs: baseline panic/growth reproduced on the stock kernel, patched kernel rejects or sanitizes the bad configs and shows none of the five defects (details in fix section of verdict.json).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.