DF-3398 VERDICT

Status: reproduced (heap OOB write, cross-object corruption of a neighbouring kernel allocation; no panic on this guest).

Root cause (line-accurate)

• sys/net/ipfw3_nat/ip_fw3_nat.c:310-311: s->alias_port = htons(s->src_addr * s->dst_addr % ALIAS_RANGE); — src/dst are host-order u32 (ip_fw3.c:413-414 ntohl's into f_id); the product is computed in 32-bit wrapping C arithmetic.
• sys/net/ipfw3_nat/ip_fw3_nat.c:326: alias->icmp_in[s->alias_port] = s2; — raw (byte-swapped on LE) index, no ALIAS_BEGIN offset, no bounds check.
• sys/net/ipfw3_nat/ip_fw3_nat.h:133: icmp_in[ALIAS_RANGE=64511] is the final member of struct cfg_alias (24 B header: LIST_ENTRY next+le_prev, in_addr ip + pad; then tcp_in, udp_in, icmp_in) — total 1,548,288 B.

Index math: x ∈ [0,64510] = wrapped residue; raw index = bswap16(x); OOB iff x's low byte ∈ {0xFC..0xFF} (1012 residues ≈ 1.57%); write lands at 8..8184 B past the allocation end. Attacker-steerable: choosing src/dst chooses x (PoC brute-forces dst; the 32-bit wrap keeps every residue reachable).

How it was proven (6-vCPU guest, stock INVARIANTS kernel #0)

1. Rebuilt the stock module from pristine source; configured ipfw3 nat 1 config ip 10.0.2.15 + nat 1 icmp out via vtnet0.
2. Triggered with x = 0x00FC (raw index 64512). The stack processed the flow on cpu0 (raw-IP dispatch); resolved cpu0's cfg_alias chain through /dev/kmem (ip_fw3_nat_ctx runtime symbol of the loaded module).
3. Baseline: qword at alias_end+16 = 0xfffff8004f1025c0 — an M_IPFW3_NAT heap pointer — where the neighbouring cfg_alias's ip field (10.0.2.15 = 0x0f02000a, intact on every other cpu at the same offset) used to be. That is the nat_state2* written by icmp_in[64512], 16 bytes past the allocation, corrupting a second kernel object. (run.log)
4. Diagnostic instrumented module (kprintf only): rawport=64514, rawport=64515 for x=0x2fc/0x3fc — the raw index the stock store uses is exactly the byte-swapped residue. (run.log)
5. Fix validation (fix.diff: store at the host-order residue icmp_in[x], bounds-check + ntohs the inbound lookup): identical trigger on the fixed module leaves the neighbour ip intact at +16 on all cpus and puts the state in-bounds — icmp_in[252] = 0xfffff8004f1025e0 read immediately after the trigger. (fix_run.log)
6. ICMP NAT still translates after the fix (tcpdump showed the full outbound/request/reply/forwarded-translation quad with net.inet.ip.forwarding=1) — no functional regression.

Course corrections during verification (honesty notes)

• The first-generation oracle ("third packet" translations in tcpdump) was invalid: my initial arithmetic ignored the mod-2^32 wrap of the product, so the flows I sent had residues like 36656 whose byte-swapped indices are in-bounds; those translations exercised normal NAT plumbing, not the OOB. The kmem differential (steps 3-5 above) is the actual proof.
• The trigger's cpu pinning is irrelevant — DFly dispatches raw-IP output to the flow's hash cpu (cpu0 here); the OOB store follows the flow.

Impact

8-byte kernel heap pointer written at an attacker-chosen 8-byte-aligned offset in an 8 KB window behind a 1.5 MB kmem allocation, repeatable at will (new icmp_id ⇒ new state ⇒ new store), value = fresh nat_state2 allocation pointer. Demonstrated consequence: silent corruption of a neighbouring cfg_alias (its alias ip — a NAT-correctness field — clobbered). Depending on allocator state the neighbour is any kmem object; spraying the ~1012 residues smears pointers across an 8 KB band. Root must configure the NAT once; afterwards every internal host / unprivileged local raw-socket user can drive it. Realistic ceiling on this guest: memory corruption + DoS; a uid=0 chain was not pursued for this NAT-only-reachable subsystem (the translation engine itself is root-configured, which lowers privesc value vs. an open local primitive).

kernel_refs

• sys/net/ipfw3_nat/ip_fw3_nat.c:310 (htons'd wrapped residue)
• sys/net/ipfw3_nat/ip_fw3_nat.c:326 (raw index OOB store)
• sys/net/ipfw3_nat/ip_fw3_nat.h:133 (icmp_in[64511], last member)
• sys/net/ipfw3/ip_fw3.c:413-414 (f_id addrs are host-order)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.