DF-3485 VERDICT — REPRODUCED (panic, deterministic, root-only)

Bottom line

Creating the first ng_iface node on the stock kernel panics instantly and 100% deterministically: panic: trying to free NULL pointer from ng_iface_constructor+0x3a2 (= the kfree(ng_iface_units, M_NETGRAPH) at sys/netgraph/iface/ng_iface.c:295, reached through the inlined ng_iface_get_unit()). Root cause is a compiler-visible UB pattern, not a stale binary: bcopy(ng_iface_units, ...) at ng_iface.c:290 feeds __builtin_memmove() a pointer that is NULL on the first call; per the in-tree contract in sys/sys/systm.h:257-260 GCC then assumes the pointer is non-NULL and deletes the if (ng_iface_units != NULL) guard at :294, so the compiled module calls kfree(NULL) unconditionally on the array-growth path — which is exactly the first-creation path. kfree(NULL) is an unconditional panic() (sys/kern/kern_slaballoc.c:1406-1407), so production (non-INVARIANTS) kernels are equally affected.

How it was proven

1. Live reproduction (fresh boot, stock modules): kldload ng_socket ng_iface; ngctl mkpeer . iface inet inet → instant panic, guest dead, trace in panic.txt. Reproduced on every attempt (3/3 across independent boots; also independently observed during the DF-3482 ng_ppp run).
2. Machine-code proof: objdump of the shipped module (disasm.stock.txt) shows the load of ng_iface_units at +0x31d flowing into call _kfree at +0x39d with no NULL test in between (relocations identify _kfree, M_NETGRAPH, and the .bss globals). The return address +0x3a2 in the panic trace matches this exact call. DWARF maps the call to ng_iface.c:295 via the inlined ng_iface_get_unit.
3. Not a stale binary: rebuilding the module from the unmodified /usr/src (md5-identical to the audit tree) reproduces the identical unguarded pattern — this is what the current tree compiles to.
4. Why the guard vanished: systm.h:257-260 documents that bcopy()→__builtin_memmove() lets GCC "optimize-out later NULL tests" on the operands — precisely what happened to the :294 guard.
5. Fix validation (fix.diff, module rebuild only): - disasm.fixed.txt: a real test/je now dominates both bcopy and kfree. - Live: with only this fix, the free-NULL panic is GONE; creation now panics later at the if_attach() call (ng_iface.c:605) with the distinct DF-3486 signature (panic.after_fix.txt). - With DF-3486's fix too, the full ng_iface lifecycle (create, list, ifconfig ng0, shutdown incl. deferred if_detach, 22+ rapid create/destroy cycles) succeeds without any panic (findings/poc/DF-3486/fix_run.log).

Reachability / severity

• Trigger: root only. The only entry to node creation is a netgraph control message; AF_NETGRAPH control sockets require caps_priv_check(SYSCAP_RESTRICTEDROOT) (ng_socket.c:172-176) — verified live: uid-1001 ngctl gets EPERM (unpriv_check.log).
• Impact: deterministic kernel panic (DoS) by an already-privileged user; no memory corruption occurs (the allocator checks NULL before touching anything). Severity Low.

Relation to DF-3482's lead

The DF-3482 lead said ng_eiface panics with "trying to free NULL pointer at ng_eiface_constructor+0xf6". That was an extrapolation from a truncated console window; the actual ng_eiface panic is a different defect (DF-3486). This pack fixes the iface-only NULL-free. ng_eiface has no get_unit bitmap and is not affected by DF-3485's root cause.

Residual notes

• ng_iface_units bitmap itself remains unsynchronized, but v1 node creation is serialized on the netisr control path, so no concurrent access exists today.
• The B-only regression observed mid-validation (free-NULL panic returning after a crash) was HAMMER2 write-loss reverting /usr/src edits made ~60s before a panic — an environment artifact, documented here so nobody chases it as a "fix regression".

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.