DF-3407 — VERDICT

Status: REPRODUCED (panic, 3 distinct kernel-panic signatures across the lifetime race family); fix validated after 3 iterations (v3 clean, 2×120s stress runs).

Baseline (stock kernel #0, INVARIANTS)

Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC, vm.sh reset with-src fresh boot. PoC race_tun.c: parent loops open("/dev/tun")/close() (autoclone open creates a unit via tunclone() → if_clone_create(), close auto-destroys via tunclose() → if_clone_destroy(), sys/net/tun/if_tun.c:352); a forked child hammers SIOCIFDESTROY on tun0..tun32 through an AF_ROUTE socket.

Run 1 (≤60s): panic (panic.txt):

panic: if_clone_free_unit: bit is already cleared
if_clone_destroy() at if_clone_destroy+0x7c
tunclose() at tunclose+0x2ba
dev_dclose() ...

Root cause (three unsynchronized lifetime domains + one framework TOCTOU)

The cdev side of tun(4) takes no lock at all, while the whole clone create/destroy side runs under the ifnet lock (sys/net/if_clone.c:74-95). The race family:

1. destroy-vs-close: tunclose() clears TUN_OPEN at if_tun.c:317 and runs a long unlocked body (:320-347: purge, if_down, if_purgeaddrs_nolink, EVENTHANDLER, rt_ifannouncemsg, funsetown, KNOTE) before its own if_clone_destroy() at :352. From the moment TUN_OPEN clears, a concurrent SIOCIFDESTROY passes the gate in tun_clone_destroy() (:419) and tundestroy() frees the softc (kfree, :270) while tunclose still dereferences it (UAF).
2. open NULL-resurrection: tunopen() (:286-287) resurrects (tuncreate) when dev->si_drv1 == NULL — which, post-destroy, means the cdev is already in destroy_dev() putaway.
3. if_clone_destroy lookup/act TOCTOU (sys/net/if_clone.c:110-132): the framework looks the ifnet up under the ifnet lock, drops the lock, then re-acquires and runs if_clone_free_unit() / ifc->ifc_destroy(ifp) on the stale ifp. Two concurrent destroyers of the same unit both pass the lookup and then double-run the teardown: KKASSERT "bit is already cleared" on INVARIANTS builds (observed), and — without INVARIANTS — a double bit-clear plus tun_clone_destroy() on a freed ifnet (UAF).

Domain 1+3 together produced the baseline panic; the exact interleave is tunclose and SIOCIFDESTROY both carrying the same unit through if_clone_destroy()'s unlocked gap.

Fix validation — 3 iterations (this is the interesting part)

• v1 (if_tun.c only: ifnet_lock around tunopen/tunclose critical sections): race re-run → panic moved to domain 2 (panic.2.txt): tunopen → tuncreate → reference_dev → sysref_get: assertion "(sr->flags & SRF_PUTAWAY) == 0" — proof that the NULL-resurrection window is independently live.
• v2 (v1 + no-resurrect: sc == NULL → ENXIO under the lock): race re-run → panic back at domain 1+3 signature (tunclose+0x24f → if_clone_destroy → if_clone_free_unit), exposing the framework lookup/act TOCTOU: serialization of the tun paths cannot close a window inside if_clone_destroy itself.
• v3 (v2 + if_clone.c: hold the ifnet lock across lookup→free_unit→destroy): race re-run 2×120s (56521 and 59259 open/close cycles against the destroyer child): clean exit both times, guest up, no panic (run.fix.log, run.fix.2.log). ifc_destroy (tundestroy) was already invoked under this lock by the original code path, so the lock condition is unchanged for every cloner.

Baseline: panic in ≤60s (1/1 runs). Patched v3: no panic in 240s of racing (2/2 runs).

Exploitability / escalation ceiling

Every entry point in the race is root-gated: tunopen() requires caps_priv_check(SYSCAP_RESTRICTEDROOT) (if_tun.c:283 — refused in jails), SIOCIFCREATE/SIOCIFDESTROY are root-gated (sys/net/if.c:2008-2017). No unprivileged reachability exists, so a uid=0 chain is impossible by construction; the ceiling is a root-triggered kernel panic / UAF of tun_softc/ifnet. (Note: the if_clone.c TOCTOU half is triggerable by any two concurrent ifconfig <clonable-if> destroy callers — still root-only — and is filed as the framework component DF-3414.)

Artifacts

panic.txt, panic.2.txt (resurrection panic on v1), run.log (baseline), run.fix.log + run.fix.2.log (v3 clean), fix.diff (v3, two files), fix_kernel_info.txt (kernel #1 of 09:05:29, KERNEL_RC=0/INSTALL_RC=0), env.txt, build.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.