DF-3383 — bpfdetach() removes only the first bpf_if of an interface

What

bpfdetach() (sys/net/bpf.c:1558-1593) walks bpf_iflist, breaks at the first entry whose bif_ifp matches, detaches that entry's descriptors, unlinks and frees only that one struct bpf_if. Interfaces can carry several bpf_if entries: every wlan vap gets DLT_IEEE802_11_RADIO in addition to the Ethernet entry via ieee80211_radiotap_vattach() → bpfattach_dlt(vap->iv_ifp, DLT_IEEE802_11_RADIO, ..., &vap->iv_rawbpf) (netproto/802_11/wlan/ieee80211_radiotap.c:126-134), and ieee80211_radiotap_vdetach() is an empty function whose comment claims "bpfattach is called by ether_ifattach and claims all taps" — which bpfdetach() does not do (it frees exactly one).

Consequences after ifconfig wlanX destroy (radiotap entry is younger, hence at the head of bpf_iflist, so the Ethernet entry is the survivor):

1. The surviving bpf_if stays in bpf_iflist with bif_ifp pointing at the freed ifnet (if_detach frees it) and bif_driverp == &ifp->if_bpf pointing into freed memory.
2. Descriptors still bound to the surviving entry are never woken (bpfdetach only notifies the first entry's dlist); their later bpfclose() → bpf_detachd() executes *bp->bif_driverp = NULL (write into freed ifnet) and ifpromisc(freed_ifp, 0) (UAF through freed ifnet, incl. if_ioctl dispatch) when bd_promisc was set.
3. BIOCGETIF/BIOCGDLT on such a descriptor read ifp->if_xname from freed memory (kernel info leak into a privileged fd).
4. If a new ifnet is later allocated at the reused address, the stale entry aliases the new interface with the wrong DLT/driverp, and bpf_attachd() does *bp->bif_driverp = bp into foreign memory.

Also, the "interface wasn't attached" path is broken: when the loop exits with bp == NULL, bp->bif_ifp (bpf.c:1574) NULL-derefs instead of reaching the intended kprintf("bpfdetach: %s was not attached") — any driver that calls bpfdetach() for a never-attached interface panics (attacker reachability depends on such a driver; none found in-tree).

Why not reproduced on this guest

Triggering requires a wlan vap (two bpf_if entries on one ifnet). The QEMU guest has no 802.11 parent device: ifconfig wlan0 create wlandev ath0 → SIOCIFCREATE2: Device not configured (wlan.ko loads fine). No in-tree code path other than ieee80211 radiotap creates a second bpf_if. The defect is certain from code reading; the trigger hardware is absent — classification not_reproduced (feature absent), not false-positive.

Fix

bpfdetach() must iterate over all matching entries (detach their descriptor lists, unlink and free each), and check bp == NULL before bp->bif_ifp:

-   for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
-       if (ifp == bp->bif_ifp)
-           break;
-       bp_prev = bp;
-   }
-   /* Interface wasn't attached */
-   if (bp->bif_ifp == NULL) {
+   for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
+       if (ifp == bp->bif_ifp) {
+           while ((d = SLIST_FIRST(&bp->bif_dlist)) != NULL) {
+               bpf_detachd(d);
+               bpf_wakeup(d);
+           }
+           /* unlink bp (track prev per iteration) */
+           ...
+       }
+   }
+   if (found == 0) {
        lwkt_reltoken(&bpf_token);
        kprintf("bpfdetach: %s was not attached\n", ifp->if_xname);
        return;
    }

(not carried in fix.diff — the validated diff targets the reproduced memory-corruption findings; this one is Medium/hardware-gated.)