DF-3382 — stale undersized BPF store buffers after interface destroy + BIOCSBLEN

What

BIOCSETBLEN guards only against d->bd_bif != NULL (bpf.c:795), but the buffer allocation in bpf_setif() guards on d->bd_sbuf == NULL (bpf.c:1128). After bpfdetach() (interface destroyed) a bound descriptor keeps its allocated buffers with bd_bif == NULL (bpf_detachd, bpf.c:320-326 via bpfdetach bpf.c:1580-1583). In that state:

1. BIOCSBLEN(0x80000) succeeds (guard passes) — bd_bufsize is raised to 512 KiB while the kmalloc'd store/free buffers stay 4096 bytes (BPF_DEFAULTBUFSIZE).
2. BIOCSETIF(newif) sees bd_sbuf != NULL and skips bpf_allocbufs().
3. catchpacket() now believes it has 512 KiB of store buffer and appends packets at bd_sbuf + curlen for ~512 KiB — writing hundreds of KiB of attacker packet data past the 4096-byte allocation.

Reproduce (in guest)

ifconfig tun0 create
cc -O -o trigger trigger.c
./trigger

Expected: mass kernel heap corruption → panic/fatal trap shortly after the loopback flood begins.

Observed: all 512 packets sent (lo0 tap appends ~1.4 KiB each into a 4096-byte buffer with bd_bufsize=524288), process printed "survived", and the kernel died seconds later in the namecache path (see panic.txt):

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer = 0x8:0xffffffff806dea20
Stopped at cache_nlookup_maybe_shared+0x100: cmpq %rax,0x48(%rbx)

The GPF'd cmpq was reading a corrupted namecache object — the overflow had crossed into kernel slab memory filled with 0x41 ('A') payload bytes.

Fix

Same fix.diff as DF-3381: BIOCSETBLEN is rejected once bd_sbuf != NULL.

DF-3382 VERDICT

Reproduced: YES (first attempt)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS).

Exact sequence (run.log):

1. ifconfig tun0 create (if_tun is compiled in; bpfattach DLT_NULL, if_tun.c:239).
2. open /dev/bpf1, BIOCSETIF("tun0") → bpf_allocbufs() allocates two 4096-byte buffers (bpf.c:1475-1476).
3. ifconfig tun0 destroy → bpfdetach() → bpf_detachd(): bd_bif=NULL, buffers retained (bpf.c:320-326).
4. BIOCSBLEN(0x80000) → accepted (bd_bif==NULL, bpf.c:795-805) → bd_bufsize=524288. Program printed [+] BIOCSBLEN -> 524288 (buffers still 4096!).
5. BIOCSETIF("lo0") → bd_sbuf != NULL → allocation skipped (bpf.c:1128).
6. 512 loopback UDP packets of 1400 'A' bytes: every catchpacket() appends at bd_sbuf+curlen; rotation only when curlen+totlen > 512KiB, so the write stream runs ~731 KiB through a 4096-byte allocation.

Result: the process itself completed ("survived", exit 0) but the kernel died moments later with a general protection fault in cache_nlookup_maybe_shared+0x100 while dereferencing a corrupted namecache link (panic.txt from the serial console). That is heap corruption consuming unrelated kernel subsystems — a stronger demonstration than a direct panic: ~727 KiB of controlled 0x41 data was written past the victim allocation.

Primitive characterization

• What: effectively unbounded linear heap overflow (up to bd_bufsize = 512 KiB per store-buffer cycle) with fully controlled content (packet bytes) and start offset (curlen advances by captured packet sizes).
• Survivability: unlike DF-3381 the copy length is legitimate per packet; the kernel kept running for seconds after corrupting ~727 KiB of adjacent memory — a corrupt-and-continue primitive, strictly more exploitable than DF-3381's fixed-4GiB copy.
• Privilege gate: reaching step 3 requires destroying an interface (root). Steps 4-6 require only the open bpf descriptor, so like DF-3381 the ioctls and traffic can come from a privilege-dropped fd holder; the destroy itself needs root, making the practical model root-configured / unprivileged-triggered.
• uid0 route: not completed. A credible chain would spray kmalloc(4096) victim objects (e.g. file-table entries, kqueue structures) around the store buffer, overflow with forged objects, and resume execution — the guest has no SMAP/SMEP/KASLR — but the trigger needs a root-orchestrated interface destroy, so a real-world privilege boundary is only crossed in the dropped-daemon-holding-fd scenario. Documented as the ceiling; not pursued to a uid0 shell within this run (time budget spent on fix validation, which is mandatory).

Fix validation

fix.diff (shared with DF-3381): BIOCSETBLEN now also rejects when d->bd_sbuf != NULL. On the patched kernel the PoC fails cleanly at step 4 (BIOCSBLEN: Invalid argument, run.patched.log), guest survives, and the identical sequence cannot desynchronize bd_bufsize from the allocated buffers. fix_baseline_reproduced=1, fix_patched_reproduced=0.

kernel refs: sys/net/bpf.c:794-806 (BIOCSBLEN guard), 1128-1134 (setif alloc guard), 320-326 (bpf_detachd keeps buffers), 1580-1583 (bpfdetach loop), 1418-1463 (catchpacket appends).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.