DF-3471

One-sided bound checks in the ratectl registry: ieee80211_ratectl_register/unregister/set accept negative type (OOB access below the ratectls[] function-pointer table); currently unreachable — all call sites pass constants

Summary

register/unregister/set check only 'type >= IEEE80211_RATECTL_MAX'; a negative type indexes below ratectls[]/ratectl_mod_names[] - in set() that is an OOB read of a function-pointer table stored into vap->iv_rate and then indirectly called. No reachable path today (no IEEE80211_IOC_RATECTL ioctl exists in DF's net80211; every caller passes a compile-time constant). Hardening to mirror the DF-3464 family fix. Fix: two-sided bound checks at all three sites. [VERIFIED pass2: one-sided type bounds confirmed; negative type unreachable constants; type-lt-0 guards compiled]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory leaks / uninitialized disclosure
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-129
File: sys/netproto/802_11/wlan/ieee80211_ratectl.c
Lines: 60-140
Area: net
Discovered: 2026-09-13
Updated: 2026-09-13

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:05
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:05
Runtime: —
Kernel: per-fix-DF-3471
fix.diff: findings/poc/DF-3471/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3471 · 4 files

File	Type	Size
README.md	—	236 B	↓ raw
fix.diff	—	867 B	view raw
manifest.json	—	391 B	view raw
verdict.json	—	1.5 KB	view raw

README.md

↓ download raw

DF-3471 evidence pack

What

ratectl registry index checks are one-sided (negative type OOB)

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-3471

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - all call sites pass constants

Verified recommended fix

type < 0 guards in register/unregister/set

Verdict

Line-accurate confirmation: ieee80211_ratectl_register/unregister (ieee80211_ratectl.c:57-73) and ieee80211_ratectl_set (:135+) check only type >= IEEE80211_RATECTL_MAX; a negative type indexes below ratectls[]/ratectl_mod_names[] and set() stores the OOB-read function pointer into vap->iv_rate for later indirect call. Unreachable today (no IEEE80211_IOC_RATECTL ioctl exists in DFs net80211; every caller passes a compile-time constant). Fix adds type < 0 guards at all three sites; compiled in the F40FIX build.