DF-3475 — ng_callout() silently discards the previously-armed item (leak on re-arm while pending)

Where

sys/netgraph7/netgraph/ng_base.c:3247-3269 (ng_callout()):

    oitem = callout_arg(c);
    callout_reset(c, ticks, &ng_callout_trampoline, item);
    return (0);

oitem is read and then dropped on the floor. If the callout was still pending (armed by a previous ng_callout() and not yet fired), the old item is orphaned: nothing owns it, ng_uncallout() can no longer reach it, and the NG_NODE_REF/NG_HOOK_REF taken for it in ng_callout() are never released.

Impact

• One leaked struct ng_item per re-arm-while-pending.
• Worse: the leaked item pins a node reference — the node can never reach refs==0, so ng_unref_node() never frees it (M_NETGRAPH_NODE leak) and the node type's refs never returns to 1, making the type permanently unloadable (kldunload returns EBUSY forever).

Severity Info: requires a node type that re-arms the same struct callout via ng_callout() while it is still pending (an API misuse, but one the API silently accepts — FreeBSD's ng_callout historically freed/reused oitem, and the read of oitem here shows the intent was to handle it). In-tree users re-arm from inside the timeout callback (safe: item already consumed) or on fresh callouts, so there is no known in-tree trigger; filed as a hardening/robustness defect of the core API.

Fix (sketch, included in fix.diff)

    oitem = callout_arg(c);
    callout_reset(c, ticks, &ng_callout_trampoline, item);
+   if (oitem != NULL && oitem != item)
+       NG_FREE_ITEM(oitem);    /* drop our orphaned reference */

with the same refs==0 caveat as DF-3474 (use ng_free_item() for a never-sent item; a fired-but-not-yet-applied item must instead be left to the queue/apply path — distinguishing those needs a flag, so the safe minimal fix is to only free when the callout was still PENDING, which callout_stop()-style return of callout_reset ... simplest correct check: if (oitem != NULL && callout_pending item was replaced) — see fix.diff for the conservative variant that only frees items that never entered the queue, tracked via NGQF_FREE already being clear and refs==0).

PoC

Skipped (Info severity — no demonstrated security impact; per audit contract Low/Info hardening findings are not QEMU-verified). Evidence pack documents the code path only.

DF-3475 — VERDICT

status: untested / impact: none (hardening) / confidence: certain (code defect), speculative (exploitability)

Pure code-analysis finding: ng_callout() (ng_base.c:3247-3269) reads oitem = callout_arg(c) and never uses it. A re-arm while the callout is still pending orphans the old item together with its node reference — the node becomes unfreeable and the type unloadable. No in-tree caller currently re-arms a pending ng_callout (grep over sys/netgraph7: all re-arms happen from inside the fired callback, where the old item was already consumed by the apply path), so there is no reachable trigger today; it is an API trap, not a live bug. Not verified on the guest (Info severity; skipped per contract). fix.diff carries the conservative one-liner (free only when the old item was never queued — refs==0 — mirroring the DF-3474 idiom).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.