DF-3466 — VERDICT

Finding: ieee80211_ageq_append() computes a relative age (age - M_AGE_GET(head), sys/netproto/802_11/wlan/ieee80211_ageq.c:114) and KASSERTs it is non-negative (:116). The DWDS staging caller (sys/netproto/802_11/wlan/ieee80211_wds.c:335) derives the requested age from ni->ni_intval, which the AP copies unvalidated from the association request's listen-interval field (ieee80211_hostap.c:1966 lintval = le16toh(...), :2130 ni->ni_intval = lintval). An associated station therefore controls the ages handed to the queue, and they are not monotonic: staging a frame with a large listen-interval first, then re-associating with a small one and staging a second frame, drives the relative age negative.

Reproduced — baseline (stock INVARIANTS kernel)

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS), up via dfbsd-qemu/vm.sh. ageqpoc.ko (this directory) drives the exported ageq API with exactly the two ages a single attacker station produces (listen-interval 2000 → age 781; then 1 → age 0):

ageqpoc: append #1 age=781 (listen-intval 2000)
ageqpoc: append #1 rc=0 aq_len=1
ageqpoc: append #2 age=0 (reassoc listen-intval 1) -> relative age 0-781 = -781
panic: age -781
Trace: ieee80211_ageq_append+0xc1 <- ageqpoc_modevent <- module_register_init
       <- linker_load_file.part.3 <- linker_load_module

Full serial-console capture: panic.txt, run.log. The ssh session died with the panic (kldload never returned) and the guest required a hard reset — classic panic reproduction.

Impact

• INVARIANTS/debug kernels: remote denial of service — any associated station on a DWDS (or mixed DWDS+mesh) vap can panic the AP with two staged 4-addr frames around a re-association. Not unauthenticated: the port must be authorized (hostap.c:654-663), but open-network APs authorize immediately after (re)assoc. hwmp.c:2236 (fixed age 15) hits the same KASSERT whenever it stages behind a wds head with >15 remaining.
• production (no INVARIANTS) kernels: the negative age is stored into m_pkthdr.csum_data (M_AGE_SET) and the frame simply expires one sweep early — no memory unsafety. This bounds severity at Medium.

No escalation chain exists: the primitive is a controlled-constant KASSERT panic, not memory corruption. uid0 is not reachable from this bug.

Fix validation (mandatory for reproduced findings — done)

fix.diff (this directory) clamps the relative age at 0 inside ieee80211_ageq_append before the KASSERT, protecting all callers (wds, mesh, hwmp) at once. Applied to the guest's /usr/src copy, kernel rebuilt with make -j4 nativekernel KERNCONF=X86_64_GENERIC + make installkernel, rebooted:

• baseline kernel #0: panic: age -781 (see run.log / panic.txt)
• patched kernel #1 (uname below): identical PoC → append #2 rc=0 aq_len=2, no panic, module unloads cleanly, guest stays up (see run.2.log)

fix_kernel_uname: DragonFly dfbsd 6.5-DEVELOPMENT #1: Sun Sep 13 09:29:00 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Guest was reset to the clean-source snapshot after validation.

Recommended hardening (in addition to the clamp)

Validate the association listen-interval at parse time (e.g. reject lintval==0 / clamp to [1,600]) — several consumers trust ni_intval.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.