DF-3429 — DWDS discovery staged frames leak on age-out (remote DoS)

Build / Run

• No userland build: kernel-side defect.
• ./run.sh — documents the hardware gate on the audit guest (no radio attaches; ifconfig -C shows no usable wlandev), so the path cannot be exercised in QEMU. All analysis is line-verified against both this tree and FreeBSD HEAD (identical defect inherited).

Mechanism (path:line)

1. Attacker (authorized station of an AP vap) sends 4-address data frames.
2. hostap_input → dir == DSTODS && ni->ni_wdsvap == NULL + authorized → ieee80211_dwds_discover(ni, m) (ieee80211_hostap.c:654-667).
3. ieee80211_dwds_discover (ieee80211_wds.c:321-338) tags the mbuf with the MAC hash and appends it to ic->ic_stageq with a finite TTL.
4. If a WDS vap is plumbed, wds_flush (ieee80211_wds.c:102-122) pulls the frames back out — no leak.
5. If NOT serviced, ieee80211_node_timeout fires every IEEE80211_INACT_WAIT and calls ieee80211_ageq_age(&ic->ic_stageq, IEEE80211_INACT_WAIT) (ieee80211_node.c:2255) — return value (list of expired frames) ignored. ieee80211_ageq_age (ieee80211_ageq.c:162-185) removes the expired frames and returns them for the caller to free. They are dropped on the floor: permanent leak of mbuf + 2KB cluster per frame.

Impact

Remote, unauthenticated-after-association kernel memory exhaustion: sustained 4-addr frames at rate R ≈ R × 2KB/s leaked forever. Queue bound (aq_maxlen = ic_max_keyix * 8) only bounds the backlog, not the leak. Prerequisite: AP-mode vap with DWDS-capable setup and discovery events not consumed (daemon absent/restarting) — a common field state.

Upstream

FreeBSD HEAD sys/net80211/ieee80211_node.c:2568 has the identical bare ieee80211_ageq_age(&ic->ic_stageq, IEEE80211_INACT_WAIT); — inherited defect; upstream disclosure recommended together with the DFly fix.

Verdict

inconclusive — mechanics certain from source; runtime verification hardware-gated (QEMU guest has no 802.11 radio; wlan_gate.txt).

DF-3429 VERDICT — stageq expired-frame leak (DWDS discovery)

status: inconclusive | reproduced: 0 | impact: none demonstrated (hw-gated) | finding severity: Medium (remote memory-exhaustion DoS)

Reproduced?

No — and cannot be, on this guest: exercising the path requires an 802.11 radio (driver → ieee80211com → AP vap → associated station sending 4-addr frames). The QEMU guest has none: kldload if_iwm/if_run attach no device, pciconf -l lists zero wireless controllers, ifconfig -C shows the wlan cloner but no wlandev exists (wlan_gate.txt). The mechanics are nevertheless certain from source, with an upstream cross-check:

• ieee80211_ageq_age() (sys/netproto/802_11/wlan/ieee80211_ageq.c:162-185) removes expired frames and returns them as an m_nextpkt list ("The list of removed frames is returned to the caller" — its own comment, ageq.c:157-159).
• ieee80211_node_timeout() (ieee80211_node.c:2255) calls it as a bare statement — the returned list is unreachable → leaked (mbuf + cluster per frame; staged DWDS frames are raw RX frames, not M_ENCAP, so no node ref rides along — pure mbuf/cluster leak).
• Producer: ieee80211_dwds_discover (ieee80211_wds.c:333-337) appends every authorized station's 4-addr frame to ic->ic_stageq with a finite TTL ((ni_intval * ic_lintval << 2) / 1024 s — the DF-0618 expression; normal values ≈ tens of seconds).
• Gate: ieee80211_hostap.c:654-667 — requires ieee80211_node_is_authorized(ni), i.e. attacker must complete association (+802.1X if enabled). Open/PSK networks: trivial.
• FreeBSD HEAD comparison: identical bare call at sys/net80211/ieee80211_node.c:2568 (fetched 2026-09-12) — inherited.

Why "inconclusive" and not "not_reproduced"

The classification difference matters: nothing about the code failed to behave — the environment cannot host the behavior at all. If a USB radio were passed through, the trigger is: AP vap up, associate, send 4-addr frames for ~TTL+20s with no WDS vap created, observe netstat -m/mbstat cluster count monotonically increase with no mbuf returned (or vmstat -m M_MBUFCL growth), repeatable across runs.

Fix

Consume the returned list in ieee80211_node_timeout: struct mbuf *m; m = ieee80211_ageq_age(...); if (m != NULL) ieee80211_ageq_mfree(m); (ieee80211_ageq_mfree applies M_ENCAP node-ref rules — ageq.c:87-98). See fix.diff (against node.c). Fix-status not_testable (hw-gated).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.