DF-3417

in6_ifdetach purges UDP moptions from udbinfo[0] only while the IPv4 twin loops all CPUs — latent purge gap that is complete today only by accident of udp6_attach()

Summary

in6_ifdetach_dispatch calls in6_pcbpurgeif0(&udbinfo[0]) whereas the IPv4 twin loops all CPUs. Phase V REFUTED current reachability: IPv6 UDP pcbs are ALWAYS on udbinfo[0] (udp6_attach hardcodes it; udp6_bind/connect never migrate). Guest A/B (pack): cpu0 and cpu1-labeled runs both purge cleanly (STALEIDX=0). Filed as Info hardening: if IPv6 UDP ever adopts per-CPU migration, the purge silently misses every non-zero-CPU pcb and resurrects the DF-3308 dangling-im6o/double-free class for UDP. Negative record + PoC pack kept. Fix: mirror the IPv4 twin's per-CPU loop.

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-667
File: sys/netinet6/in6_ifattach.c
Lines: 818-819
Area: net
Discovered: 2026-09-12
Updated: 2026-09-12

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-09-12 11:34:04
Attempts: 2
Runtime: 300s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 (stock INVARIANTS)
Build cmd: cc in-guest (A/B purge probe)
Run cmd: sh findings/poc/DF-3417/run.sh

jump to evidence pack ↓

PoC verification

Evidence pack

findings/poc/DF-3417 · 3 files

File	Type	Size
mship.c	—	4.2 KB	view raw
build.sh	—	87 B	view raw
build.log	—	280 B	view raw

Confirmed kernel references

Detail

Exploit chain

n/a - honestly refuted; hardening

Evidence (decisive lines)

['findings/poc/DF-3417/README.md', 'findings/poc/DF-3417/run.sh']

PoC changes

verdict.json reconstructed by the orchestrator (analysis-only Info finding, pack has README/PoC but no reviewer verdict.json).

Verified recommended fix

Loop over all CPUs calling in6_pcbpurgeif0(&udbinfo[cpu]) as in.c does.

Verdict

REFUTED as reachable today: IPv6 UDP pcbs are always on udbinfo[0] (udp6_attach hardcodes it; bind/connect never migrate), so the single-pcbinfo purge is complete - guest A/B (cpu0 vs cpu1-labeled runs) both purged cleanly (STALEIDX=0). Filed Info/latent: any future per-CPU udp6 migration resurrects the DF-3308 class for UDP. Fix: mirror the IPv4 twin's per-CPU loop.