DF-3440 — div_output() reads an under-sized destination sockaddr

div_send() (sys/netinet/ip_divert.c:494-508) hands the user sendto() destination to div_output() (ip_divert.c:317-373) with no length validation. getsockaddr() (kern/uipc_syscalls.c:1513-1532) kmalloc's exactly namelen bytes (min 4). div_output() reads:

• sin->sin_port at offset 4..8 (OOB for namelen < 8) -> divinfo->skipto
• sin->sin_addr at offset 8..12 (OOB for namelen < 12) -> re-inject direction via DIV_IS_OUTPUT(sin) (== 0 -> ip_output, else -> ip_input)

Both values steer kernel control flow from bytes past the user allocation.

Build / run (root: divert socket)

cc -O -o div3440 div3440.c && ./div3440        # counter/oracle variant
cc -O -o divleak divleak.c && ./divleak        # skipto-canary readback
cc -O -o divsteer divsteer.c && ./divsteer     # groom steering variant

Observed

Every sendto() with a 4- or 9-byte sockaddr returns success — the kernel accepted an under-sized destination and executed the OOB reads (reinject observed in ip counters). Deterministic value steering / readback could not be produced on this allocator (grooms don't land; same experience as the verified DF-3357 PoC on this guest). See run.log and VERDICT.md.

DF-3440 — VERDICT

Status: not_reproduced (impact demonstrated as none; the defect itself is source-certain and its code path provably executes).

What is certain (source)

• div_send -> div_output with zero validation between getsockaddr() (4-byte minimum allocation) and the field reads (ip_divert.c:344-350).
• sin_port (4..8) becomes divinfo->skipto — the firewall resume rule on reinject; sin_addr (8..12) selects ip_output vs ip_input.
• For namelen=4 (8-byte chunk): sin_port = own-chunk slack (recycled heap), sin_addr = adjacent chunk bytes 0..4.

What was demonstrated on the guest

• sendto(divert_fd, pkt, 48, {4-byte sockaddr}, 4) succeeds (rc=48) — the under-sized sockaddr flowed through div_output and the packet was reinjected (ip counters moved). Same for 9-byte sockaddrs. 12+ shots.
• The OUTPUT/INPUT branch machinery works (16-byte controls produced the expected reinject signatures in netstat -s -p ip deltas).

What could NOT be demonstrated

• Deterministic steering/readback of the OOB bytes:
• counter oracles are per-CPU/noisy on DF;
• the ipfw hooks exist only in the ether layer (if_ethersubr.c:466,1061), so loopback reinjects never re-match a divert rule;
• with one_pass=0 the resume rule equals the very skipto bytes under test (never < 100 in observed heap states -> rule 100 never re-matched);
• groom chunks are not the ones the trigger allocation picks (identical conclusion to the verified DF-3357 PoC on this same guest/allocator).
• Hence: no observable value leak to record; classified not_reproduced with impact none. The defect remains real (read-past-object into kernel control flow on a root-only socket) — filed Medium on code certainty, consistent with the DF-0650 twin (unvalidated rip_send sockaddr, filed Medium).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)