DF-3392 VERDICT — REPRODUCED (unprivileged local firewall policy bypass)

What was run

Stock INVARIANTS guest DragonFly 6.5-DEVELOPMENT #0 (uname in env.txt). PoC ip6fw_ctl.c built in-guest (cc -O, no special headers beyond the kernel's own ip6_fw.h).

Reproduction chain (run.log, run.2.log — full untrimmed)

1. Platform fact / default-dead: with the stock kernel, net.inet6.ip6.fw.enable does not exist, kldstat shows no ip6fw, and IPV6_FW_GET as any user returns EINVAL — ip6_fw_ctl_ptr == NULL (ip6_input.c:130-131 only set by ip6_fw_init(), which runs exclusively from the module/option path; X86_64_GENERIC has no options IPV6FIREWALL).
2. Admin opt-in: root runs kldload ip6fw.ko (module shipped in /boot/kernel; userland /sbin/ip6fw shipped). Module loads with default rule 65535 deny ipv6 from any to any (IPV6FIREWALL_DEFAULT_TO_ACCEPT not defined in sys/net/ip6fw/Makefile); net.inet6.ip6.fw.enable=1 by default. ping6 -c 1 ::1 → 100% loss (policy enforcing).
3. Unprivileged manipulation: uid 65534 (nobody), plain socket(AF_INET6, SOCK_DGRAM, 0): - IPV6_FW_ADD of allow ipv6 from any to any (#1) → ret 0 - /sbin/ip6fw show (root) confirms rule 00001 allow ipv6 from any to any live in the kernel chain above the deny rule - ping6 -c 1 ::1 now → 0% loss: the admin's deny policy is bypassed by a rule an unprivileged user installed - IPV6_FW_DEL (#1) → ret 0; ping6 blocked again - IPV6_FW_ZERO, IPV6_FW_FLUSH → ret 0 (counter wipe / full chain wipe by an unprivileged user = unpriv firewall DoS)

Root cause

ip6_ctloutput() computes privileged (ip6_output.c:1156-1158, caps-based, used by at least five other option cases at :1198/:1424/:1429/:1712/:1720) but the IPV6_FW_ADD/DEL/FLUSH/ZERO (:1534-1552) and IPV6_FW_GET (:1760-1774) cases never consult it. They forward straight to ip6_fw_ctl() whose only gate is securelevel > 2 (ip6_fw.c:1119 — normally 0/-1). The option is reachable from ANY IPv6 socket: the udp6 protosw uses .pr_ctloutput = ip6_ctloutput_dispatch (in6_proto.c:142) — contrast the v4 ipfw path which requires a raw IP socket, itself gated by SYSCAP_NONET_RAW (raw_ip.c:473). No raw socket, no privilege, no jail exception for the v6 path.

Impact

Once ip6fw is active (kldload / kernel option), every local user can: - bypass the admin's IPv6 security policy (insert accept-any rule #1), - destroy it (flush / delete arbitrary rules), - DoS all IPv6 connectivity (add deny rules; default is deny), - read accounting counters reset / rule-state changes. Not uid=0: this is a policy/privilege-boundary bypass, not memory corruption.

Fix validation (fix.diff)

if (!privileged) return EPERM; added to both IPV6_FW_ cases of ip6_ctloutput. Kernel rebuilt in-guest (make nativekernel KERNCONF=X86_64_GENERIC), installed, rebooted. Baseline (stock kernel): nobody's ADD/FLUSH return 0 (run.log). Patched: nobody gets EPERM on all IPV6_FW_ ops; root's ops still succeed (fix.log). No behavior change otherwise.

Notes

IPV6_FW_GET (sockopt form) returns EINVAL both before and after module load — a separate pre-existing plumbing defect in the GET path (ip6_fw_ctl builds an mbuf chain; ip6_output.c:1771 sopt_from_mbuf on a multi-mbuf chain), unrelated to the privilege issue and NOT required for the bypass (write ops are the impact).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.