DF-3378 — MRT6_INIT rejects the standard 4-byte KAME API argument on 64-bit (sizeof(int *) vs sizeof(int))

What

ip6_mrouter_init() validates the MRT6_INIT option with

if (!m || (m->m_len != sizeof(int *)))   /* sys/netinet6/ip6_mroute.c:426 */
        return ENOPROTOOPT;

m is built by soopt_getm()/soopt_to_mbuf() so m->m_len equals the setsockopt value size. Every conforming routing daemon (pim6sd/pim6dd and the documented KAME API) passes int v = 1; setsockopt(s, IPPROTO_IPV6, MRT6_INIT, &v, sizeof(v)) — 4 bytes. On amd64 sizeof(int *) == 8, so 4 != 8 → ENOPROTOOPT: IPv6 multicast routing cannot be enabled at all on 64-bit DragonFly by any stock daemon. The subsystem becomes reachable only for a caller that happens to pass 8 bytes (first int = 1).

Side effect for triage: this gate also blocked the whole file's attack surface (DF-0423/0424-style paths) behind an API no stock daemon uses — while custom / 8-byte callers get full access.

Reproduce (deterministic, root, stock kernel #0)

# cc -O -Wall -o /tmp/df3378 /root/poc/trigger_mrt6_init.c && /tmp/df3378
MRT6_INIT(4-byte int arg): rc=-1 errno=42 (Protocol not available)   <- the bug
MRT6_INIT(8-byte arg):     rc=0  errno=0 (Success)

Fixed kernel (m->m_len < sizeof(int)): first line becomes rc=0.

Files

• trigger_mrt6_init.c, build.sh, run.sh, run.log, fix.diff
• VERDICT.md, manifest.json, verdict.json

DF-3378 VERDICT — REPRODUCED (deterministic; MRT6_INIT gate uses sizeof(int*) so IPv6 multicast routing cannot be enabled by conforming daemons on amd64)

Bottom line

ip6_mrouter_init() gates MRT6_INIT on m->m_len != sizeof(int *) (sys/netinet6/ip6_mroute.c:426). m comes from soopt_getm() / soopt_to_mbuf() (sys/kern/uipc_socket.c:2438-2492), which sets m->m_len = sopt_valsize. The documented KAME/pim6sd API passes a 4-byte int — on amd64 sizeof(int *) == 8 so every conforming daemon gets ENOPROTOOPT and IPv6 multicast routing cannot be enabled at all. Only a caller passing 8 bytes (first int = 1) initializes the subsystem. Verified deterministically on the guest stock kernel #0 and after the one-line fix on kernel #1. Functional availability bug of a root-only subsystem (no memory safety impact); also a reachability gate for every other path in the file (stock daemons never reach them; custom 8-byte callers do).

Reproduction (stock kernel #0, root)

$ cc -O -Wall -o /tmp/df3378 trigger_mrt6_init.c && /tmp/df3378
MRT6_INIT(4-byte int arg): rc=-1 errno=42 (Protocol not available)   <- bug
MRT6_INIT(8-byte arg):     rc=0  errno=0 (Success)

(run.log). errno 42 = ENOPROTOOPT exactly at ip6_mroute.c:426-427.

Fix validation (kernel #1)

m->m_len != sizeof(int *) → m->m_len < sizeof(int) (fix.diff; same line FreeBSD uses). On kernel #1:

MRT6_INIT(4-byte int arg): rc=0 errno=0 (Success)          <- fixed
MRT6_INIT(8-byte arg):     rc=-1 errno=48 (Address already in use)

(fix_run.log). The second line's EADDRINUSE is correct behavior: the first call now succeeds and claims ip6_mrouter, so the second INIT is refused — proof the gate opened. fix_status=fixed.

Severity rationale

Low: requires root (raw ICMPv6 socket) to even call; impact is "feature unusable / wrong errno", no crash, no leak, no bypass. Triage value is high though: it proves all mroute6 attack-surface findings (incl. DF-0423) are unreachable via stock daemons on amd64, while custom callers (or a fixed kernel) reach them.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.