DF-3449 — dummynet3 KLD unload leaves stale ipfw3 filter hooks → deterministic call into unmapped module text

Files

• trigger.sh — full reproduction, runs detached on the guest (root).
• trigger_fixed.sh — fix-validation run (patched module).
• run.sh — step-by-step equivalent (documented; the automated trigger.sh is what was actually executed because the panic kills ssh).
• panic.txt / console_full.txt — serial-console capture of the panic.
• run.patched.log — full untrimmed fixed-module run (guest alive at end).
• fix.diff — git-apply-able patch against sys/net/dummynet3/ip_dummynet3.c.
• env.txt — guest uname / kldstat / securelevel.

Build (on the guest, as root)

for d in ipfw3 ipfw3_basic dummynet3; do
    (cd /usr/src/sys/net/$d && make obj && make)
done
# artifacts:
#   /usr/obj/usr/src/sys/net/ipfw3/ipfw3.ko
#   /usr/obj/usr/src/sys/net/ipfw3_basic/ipfw3_basic.ko
#   /usr/obj/usr/src/sys/net/dummynet3/dummynet3.ko

Run (baseline, unpatched)

sh /root/df3449_trigger.sh        # uploaded from trigger.sh, run detached

The script must run detached (nohup ... &) because the panic kills ssh. Note: ipfw3_basic.ko is loaded standalone BEFORE dummynet3 on purpose — dummynet3 MODULE_DEPENDs on ipfw3_basic, and the kldunload dependency cascade would otherwise unload basic first and trip the known, separate DF-0669 rn_flush(NULL) panic in ipfw3_table.c before our bug can fire.

Expected output (baseline)

1. ipfw3 initialized, default to accept / ipfw3 module basic loaded / ipfw3 module dummynet loaded / DUMMYNET initialized (011031) on console.
2. pipe 1 configured, rule 00100 pipe 1 added, ping through the pipe works (~44 ms: 10 ms delay + 1 Mbit/s shaping).
3. kldunload dummynet3 succeeds although rule 100 references module 2 — dummynet3's MOD_UNLOAD never calls ip_fw3_unregister_module().
4. First packet after the unload: Fatal trap 12: page fault while in kernel mode fault virtual address = 0xffffffff8260d000 fault code = supervisor read instruction, page not present instruction pointer = 0x8:0xffffffff8260d000 current process = Idle 0xffffffff8260d000 is exactly the former load address of dummynet3.ko (see kldstat in run.patched.log: 6 1 0xffffffff8260d000 4000 dummynet3.ko). The RIP equals the address filter_funcs[2][O_DUMMYNET_PIPE] (= check_pipe) still holds: check_body() (ip_fw3.c:506) calls it with no NULL check after the module text was unmapped. Kernel drops into DDB; guest is dead.

Fix validation (patched)

Apply fix.diff in /usr/src, rebuild dummynet3.ko, run trigger_fixed.sh: - kldunload dummynet3 with the rule present → Device busy (EBUSY), rule and traffic keep working; - after ipfw3 delete 100 the unload succeeds (ipfw3 module dummynet unloaded on console), ping works, no panic; - adding a new pipe rule after the unload is rejected by the CLI because the module is no longer registered. Full log: run.patched.log.

DF-3449 VERDICT

Status: reproduced (deterministic kernel panic). Fix: validated. Impact: panic (privileged-setup DoS; stale call site is a text-UAF of the freed/unmapped KLD — control-flow hijack if the VA is re-populated before the call, e.g. by a subsequent kldload).

Root cause (source)

• sys/net/dummynet3/ip_dummynet3.c:1995-1999 — ip_dn_init() registers the module with ipfw3 and installs the filter functions: ip_fw3_register_module(MODULE_DUMMYNET_ID /* 2 */, "dummynet") and ip_fw3_register_filter_funcs(2, O_DUMMYNET_PIPE /* 0 */, check_pipe) / ... O_DUMMYNET_QUEUE /* 1 */, check_pipe.
• sys/net/dummynet3/ip_dummynet3.c:2013-2023 — ip_dn_stop_dispatch() (the MOD_UNLOAD body) flushes pipes and NULLs ip_dn_io_ptr/ ip_dn_ctl_ptr, but never calls ip_fw3_unregister_module(2) and never clears filter_funcs[2][]. Contrast with every sibling module: ip_fw3_basic.c:640, ip_fw3_nat.c:1056, ip_fw3_layer2.c:201, ip_fw3_layer4.c:229 — all unregister on unload, and the unregister also refuses (returns 1) while any rule still references the module.
• sys/net/ipfw3/ip_fw3.c:505-507 — the packet path check_body(): (filter_funcs[cmd->module][cmd->opcode])(&cmd_ctl, ...) is an unguarded indirect call; after kldunload unmaps the module text the slot still holds the old check_pipe address.

Consequences of the missing unregister: 1. Rules containing pipe/queue actions survive the unload and their next match calls into unmapped text (the reproduced panic). 2. fw3_modules[] still reports "dummynet" as loaded after the unload, so new pipe/queue rules can be compiled against the dead module (re-armed stale state). 3. filter_funcs[2][] stays populated, so even rule-less systems keep a dangling slot reachable by any later rule add.

Reproduction (guest: X86_64_GENERIC, INVARIANTS, DF 6.5-DEVELOPMENT

0 Thu Jul 2 06:02:54 UTC 2026)

Setup is root-gated (kldload + ipfw3 raw-socket config), the trigger packet is any traffic through the firewall (e.g. unprivileged ping).

1. sysctl net.filters_default_to_accept=1 (keep ssh alive through pfil).
2. kldload ipfw3.ko; kldload ipfw3_basic.ko (standalone — holds a reference so the unload's dependency cascade cannot unload basic first and trip the known DF-0669 rn_flush(NULL) panic in ip_fw3_table.c:578); kldload dummynet3.ko.
3. ipfw3 pipe 1 config bw 1Mbit/s delay 10ms; ipfw3 add 100 pipe 1 ip from any to any.
4. Sanity ping through the pipe: OK (~44 ms).
5. kldunload dummynet3 → succeeds (no rule check — the bug).
6. ping -c 2 127.0.0.1 → Fatal trap 12: - fault virtual address = 0xffffffff8260d000 - fault code = supervisor read instruction, page not present - instruction pointer = 0x8:0xffffffff8260d000 - current process = Idle (netisr, pfil hook context) 0xffffffff8260d000 is the exact former load address of dummynet3.ko (kldstat: 6 1 0xffffffff8260d000 4000 dummynet3.ko) — RIP is the stale check_pipe pointer still sitting in filter_funcs[2][0]. Guest drops to DDB; dead. See panic.txt / console_full.txt.

Fix validation

fix.diff makes ip_dn_stop_dispatch() call ip_fw3_unregister_module(MODULE_DUMMYNET_ID) first and reply EBUSY when rules still reference the module; ip_dn_stop()/dummynet_modevent() propagate the error so the linker keeps the module resident.

Patched run (run.patched.log, guest stays up): - kldunload dummynet3 with rule 100 present → Device busy (RC=1); ping through the pipe still works. - ipfw3 delete 100 → kldunload dummynet3 → RC=0, console prints ipfw3 module dummynet unloaded (register torn down), ping after unload works, no panic. - ipfw3 add 200 pipe 1 ... after the unload → rejected (module no longer registered) — closes re-arming vector (2) above.

Notes

• The panic observed on a naive unload (without holding ipfw3_basic loaded) is a different, already-known bug: DF-0669 (rn_flush(NULL) on never-created tables during the dependency-cascade unload of ipfw3_basic, ip_fw3_table.c:578). It is documented here only because it masks this finding's trigger path unless basic is pinned.
• The audited file sys/net/dummynet3/ip_dummynet3_glue.c is itself dead code (absent from sys/conf/files; the dummynet3 KMOD builds only ip_dummynet3.c; nothing references the glue's symbols) — the live ip_dn_sockopt the system dispatches to is the v1 twin's (sys/net/dummynet/ip_dummynet_glue.c, optional inet). This finding is filed against the glue file as the ipfw3-hook side of the dummynet3 interface, with the defect located in ip_dummynet3.c as cited.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.