DF-3370 — ip_output(): NULL rtentry dereference when DF-set packet exceeds MTU on a route-less path (kernel panic)

Target: sys/netinet/ip_output.c:712-715 — the DF/EMSGSIZE path dereferences ro->ro_rt without a NULL check:

    if (ip->ip_off & htons(IP_DF)) {
        error = EMSGSIZE;
        ...
        if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&   /* :712 — NULL! */

Reachable without a route

Two paths reach sendit→DF branch with ro->ro_rt == NULL:

1. Multicast + IP_MULTICAST_IF (ip_output.c:309-317): ifp comes from imo->imo_multicast_ifp and the route lookup is skipped entirely.
2. IP_ROUTETOIF (ip_output.c:299-308), kernel-internal.

DragonFly has no IP_DONTFRAG (sys/netinet/in.h:405 — commented out) and raw sockets are privileged (SYSCAP_NONET_RAW, raw_ip.c:473), so the DF bit comes from a raw IP_HDRINCL socket (root) or TCP (which always has a route). Trigger = root: raw socket + IP_HDRINCL + IP_MULTICAST_IF(vtnet0) + 2000-byte packet with IP_DF to 224.0.0.5 → multicast branch (ro_rt NULL, kernel #0) → ip_len > if_mtu + DF → page fault at NULL+0x70.

Note the ip6 twin guards this (ip6_output.c:1059-1064 checks ro_pmtu->ro_rt == NULL); the v4 code never got the check.

Build / run (guest, root)

cd /root/rawdf && cc -O -Wall -o rawdf rawdf.c && ./rawdf

• stock kernel #0: Fatal trap 12 ... fault virtual address = 0x70 ... Stopped at ip_output+0x5ee: testb $0x5,0x70(%rax) (see panic.txt) — 0x70 = offsetof(struct rtentry, rt_flags).
• kernel with fix.diff (NULL guard, rebuilt in-guest, kernel #2): sendto returned -1 errno=40 (Message too long) — EMSGSIZE, no panic (see run.fixed.log).

Severity is Low only because the trigger is privileged; the missing-NULL-check itself is deterministic and would also fire for any future unprivileged DF-setter.

DF-3370 — VERDICT

Status: reproduced (deterministic kernel NULL-deref panic on the stock INVARIANTS kernel; one-line fix validated on a rebuilt kernel).

What was proven, on the guest

Baseline (stock kernel #0, Thu Jul 2 06:02:54 UTC 2026), as root:

/root/rawdf/rawdf     # raw socket + IP_HDRINCL + IP_MULTICAST_IF(vtnet0)
                      # 2000-byte IP_DF packet to 224.0.0.5
→ ssh session never returns; serial console:
  Fatal trap 12: page fault while in kernel mode
  fault virtual address = 0x70
  Stopped at ip_output+0x5ee: testb $0x5,0x70(%rax)

0x70 is offsetof(struct rtentry, rt_flags); testb $0x5, 0x70(%rax) is the compile of ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST) at sys/netinet/ip_output.c:712 with ro->ro_rt == NULL. Deterministic, reproduced on first send, no race.

Reachability trace (why ro_rt is NULL)

1. raw socket (IPPROTO_RAW, IP_HDRINCL) — privileged (raw_ip.c:473 SYSCAP_NONET_RAW), DFly has no unprivileged IP_DONTFRAG (netinet/in.h:405 commented out; udp never sets IP_DF — verified by grep: only tcp_output.c:1245, tcp_syncache.c:1236, ip_carp.c:1380 set IP_DF, all unicast-with-route or kernel-internal).
2. IP_MULTICAST_IF (index form) → imo->imo_multicast_ifp = vtnet0 (ip_output.c:1494-1558 via rip_ctloutput → ip_ctloutput → ip_setmoptions).
3. sendto 2000 B to 224.0.0.5 → ip_output (rip_output passes &inp->inp_route, ro_rt NULL on first send): - ip_output.c:309-317: IN_MULTICAST && imo && imo->imo_multicast_ifp branch selects ifp without any route lookup — ro_rt stays NULL; - :345-455: multicast glue (TTL, src) → goto sendit; - :655: ip_len(2000) > if_mtu(1500); not TSO/CSUM_FRAGMENT; - :703: ip->ip_off & htons(IP_DF) → :712 ro->ro_rt->rt_flags → panic.

Severity stays Low because the trigger needs privilege on this system; the missing NULL check is nonetheless a real defect (the v6 twin guards the equivalent path: ip6_output.c:1059-1064), and any future DF-setter reachable unprivileged would promote this to an unprivileged panic.

Fix validation (full kernel rebuild)

fix.diff (one hunk: ro->ro_rt != NULL && guard at ip_output.c:712): applied to the guest's /usr/src, make -j6 nativekernel && make nativekernel installkernel, rebooted into kernel #2 (Fri Sep 11 14:47:59 UTC 2026). Re-running the exact PoC:

DF-3370: sendto returned -1 errno=40 (Message too long)
DF-3370: EMSGSIZE — patched behaviour, no panic

Guest alive, correct EMSGSIZE error returned to the socket. Baseline panic vs patched clean-return recorded in panic.txt / run.fixed.log.

Kernel refs: sys/netinet/ip_output.c:712-715 (missing NULL check), :309-317 (route-less multicast branch), :345-455, :655-658, :703-719; sys/netinet6/ip6_output.c:1059-1064 (guarded twin); sys/netinet/raw_ip.c:473 (SYSCAP_NONET_RAW), :220-290 (rip_output), :606-633 (rip_send); sys/netinet/in.h:405 (no IP_DONTFRAG).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.