⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-3455

NOL/CAC timeout arithmetic is signed-overflow and tick-wrap unsafe: sysctl ints multiplied by 1000 overflow (UB) and dfs_timeout adds NOL_TIMEOUT before the wrap-aware compare — radar'd channels can be released from the NOL immediately

Summary

ieee80211_nol_timeout/ieee80211_cac_timeout are unvalidated root-writable ints; NOL_TIMEOUT/CAC_TIMEOUT are msecs_to_ticks(v*1000) - for any value >2147483 the int multiply overflows (UB) and typically yields a negative tick count. callout_reset with a negative timeout fires immediately and dfs_timeout's test ieee80211_time_after_eq(now, dfs->nol_event[i]+NOL_TIMEOUT) performs the addition BEFORE the wrap-safe subtraction, so a negative or wrapped NOL_TIMEOUT (also reachable naturally: nol_event near INT_MAX ticks ~24.8 days uptime + 180,000-tick NOL) makes radar entries expire instantly instead of after 30 minutes; the re-arm delta wraps the same way, producing immediate re-dispatches until the table drains. Root writing a large-but-plausible quarantine value silently corrupts the DFS state machine: channels marked for radar become usable immediately (FCC/ETSI regulatory violation). Analysis-only (Low; no DFS-capable interface on the QEMU guest). Fix: clamp the sysctls, compute timeouts in int64, wrap-safe compare without pre-addition. [VERIFIED pass2: reproduced via arithmetic harness - signed-overflow NOL timeout product releases a radar-d channel about 1500 ticks early; 64-bit subtraction-form fix]

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3455 · 12 files
FileTypeDescriptionSize
README.md — 1.0 KB ↓ raw
VERDICT.md — 2.3 KB ↓ raw
allruns.log — 4.9 KB view raw
build.sh — 708 B view raw
df3455.c — 3.4 KB view raw
fixbuild.sh — 394 B view raw
fixrun.sh — 1.1 KB view raw
fixruns.log — 810 B view raw
guard.h — 1.3 KB view raw
manifest.json — 932 B view raw
run.sh — 2.0 KB view raw
verdict.json — 1.8 KB view raw
README.md
↓ download raw

DF-3455 -- verification pack

Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest) Status: REPRODUCED | impact: denial_of_service | confidence: certain

What this is

NOL/CAC timeout arithmetic overflows before the wrap-aware compare: root sysctl net.wlan.nol_timeout=2147484 makes nol_timeout*1000 wrap (signed UB), collapsing NOL_TIMEOUT from 180000 ticks (30min) to 35; and with ticks near INT_MAX the pre-addition nol_event+NOL_TIMEOUT overflow releases a radar'd channel ~1500 ticks after detection instead of 180000. Pure-arithmetic harness over the verbatim macros (wlan absent on guest).

Build

./build.sh

Run

(no arg)

(success criterion: see VERDICT.md)

Evidence

misc3.log DF-3455: [b] NOL_TIMEOUT=35 ticks; [c] released after ~1500 ticks (expected 180000)

Kernel references: sys/netproto/802_11/wlan/ieee80211_dfs.c:57-63, sys/netproto/802_11/wlan/ieee80211_dfs.c:244-247, sys/netproto/802_11/wlan/ieee80211_dfs.c:268, sys/netproto/802_11/ieee80211_dragonfly.h:130

VERDICT.md
↓ download raw

DF-3455 -- VERDICT

REPRODUCED (impact=denial_of_service, confidence=certain) Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Summary

NOL/CAC timeout arithmetic overflows before the wrap-aware compare: root sysctl net.wlan.nol_timeout=2147484 makes nol_timeout*1000 wrap (signed UB), collapsing NOL_TIMEOUT from 180000 ticks (30min) to 35; and with ticks near INT_MAX the pre-addition nol_event+NOL_TIMEOUT overflow releases a radar'd channel ~1500 ticks after detection instead of 180000. Pure-arithmetic harness over the verbatim macros (wlan absent on guest).

How it was verified

  • Method: Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
  • Kernel references: sys/netproto/802_11/wlan/ieee80211_dfs.c:57-63, sys/netproto/802_11/wlan/ieee80211_dfs.c:244-247, sys/netproto/802_11/wlan/ieee80211_dfs.c:268, sys/netproto/802_11/ieee80211_dragonfly.h:130
  • Evidence: misc3.log DF-3455: [b] NOL_TIMEOUT=35 ticks; [c] released after ~1500 ticks (expected 180000)
  • Reachability: local-unpriv where noted in the summary; root-config for tun/lagg/carp/ipfw3/gre items; remote-facing for the packet parsers (wlan harnesses model the RX/TX path verbatim because the guest has no 802.11 hardware; precedent DF-0393/DF-0594/DF-0621/DF-0350).
  • Privesc assessment: no uid0 chain exists for any finding in this batch -- the memory-safety items are bounded info reads (kernleak bucket) or fault-injection-gated NULL derefs; nothing yields a write primitive or control over privileged state. The one panic-class live item (DF-3414) is root-only (SIOCIFDESTROY).

Fix

fix_status: fixed -- Fix: clamp/64-bit the sysctl product and do the expiry compare as (int)(now - nol_event) >= NOL_TIMEOUT (subtraction-form wrap-safe compare); harness with the corrected compare holds the channel for the full 180000 ticks.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

Fix: clamp/64-bit the sysctl product and do the expiry compare as (int)(now - nol_event) >= NOL_TIMEOUT (subtraction-form wrap-safe compare); harness with the corrected compare holds the channel for the full 180000 ticks.

per-fix-DF-3455

Confirmed kernel references

Detail

Evidence (decisive lines)

misc3.log DF-3455: [b] NOL_TIMEOUT=35 ticks; [c] released after ~1500 ticks (expected 180000)

Verdict

NOL/CAC timeout arithmetic overflows before the wrap-aware compare: root sysctl net.wlan.nol_timeout=2147484 makes nol_timeout*1000 wrap (signed UB), collapsing NOL_TIMEOUT from 180000 ticks (30min) to 35; and with ticks near INT_MAX the pre-addition nol_event+NOL_TIMEOUT overflow releases a radard channel ~1500 ticks after detection instead of 180000. Pure-arithmetic harness over the verbatim macros (wlan absent on guest).