ng_fec_rcvmsg treats msg->data as a NUL-terminated interface name with no arglen validation: ifunit()/kprintf %s walk past the ng_mesg allocation (unbounded heap OOB read)
Summary
NGM_FEC_ADD_IFACE/DEL_IFACE handlers do 'ifname = msg->data;' and pass it to addport/delport with no check that arglen bytes contain a NUL. The ng_parse string type only constrains ASCII ngctl translation, not binary control messages: a raw message with arglen=0 or no NUL byte makes ifunit() (strcmp against if_xname) and the kprintf %s paths read past the kmalloc'd ng_mesg chunk until an incidental zero byte - unbounded heap over-read, panic-capable at slab/page boundaries. strcmp result is not reflected to user - fault/DoS-grade. PLATFORM FACT (proven on guest): the module is not in the build and cannot compile on this tree (81-error standalone build attempt - FreeBSD-5 APIs) + root-only NG_CONTROL gate. Not runnable on stock DFly. Fix: memchr NUL check before use. [VERIFIED pass2: dead code by construction - module SUBDIR commented out AND kernel-compile fails 76 errors FreeBSD-5 APIs; mechanism demonstrated live on the v1 twin DF-3506]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3496 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 463 B | ↓ raw | |
| VERDICT.md | — | 1.9 KB | ↓ raw | |
| env.txt | — | 309 B | view raw | |
| fix.diff | — | 615 B | view raw | |
| manifest.json | — | 751 B | view raw | |
| ng7build-fecfail.log | — | 1.1 MB | ↓ download | |
| run.log | — | 83 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-3496 - ng7 ng_fec rcvmsg NUL-unvalidated iface name (OOB read)
Dead code: module SUBDIR commented out; kernel compile with options NETGRAPH7_FEC fails with 76 errors (ng7build-fecfail.log). The identical mechanism was demonstrated live on the v1 twin - see ../DF-3506/ (fec0: tried to add iface AAAAAAAAXXXX - 4-byte over-read).
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
DF-3496 - VERDICT
status: not_reproduced | reproduced: 0 | impact: none | confidence: certain
Dead code - unreachable by construction on this tree. (1) sys/netgraph7/ng_fec.c is commented out of the netgraph7 module SUBDIR (sys/netgraph7/Makefile, '# fec \'), and (2) although conf/files:1704 lists it as 'optional netgraph7_fec', it CANNOT COMPILE: a kernel-compile attempt with options NETGRAPH7_FEC (harness config X86_64_NG7, stock X86_64_GENERIC base + NETGRAPH7 stack) failed with 76 errors - FreeBSD-5-era API usage: 'struct ifaltq_subque declared inside parameter list', 'IFF_DRV_RUNNING undeclared', 'implicit declaration of ifunit', 'IF_AFDATA_LOCK implicit', 'field fec_ch has incomplete type' (full log: ng7build-fecfail.log). This independently reproduces the pass-1 '81-error standalone build' finding. The code defect itself is line-accurate real: rcvmsg (:1287-1294) does 'ifname = msg->data' and passes it to addport/delport with no arglen/NUL validation; ifunit()/kprintf %s walk past the ng_mesg allocation until an incidental zero (same mechanism DEMONSTRATED LIVE on the v1 twin ng_fec.c, see DF-3506 pack: 'AAAAAAAAXXXX' over-read). Root-only control plane; fault/DoS-grade at slab boundaries.
Kernel references
Evidence
ng7build-fecfail.log (76 errors), Makefile excerpt, conf/files:1704, DF-3506 twin runtime demonstration
Recommended fix
if the module is ever revived: memchr NUL + arglen check before use; otherwise delete the file.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ng7build-fecfail.log (76 errors), Makefile excerpt, conf/files:1704, DF-3506 twin runtime demonstration
PoC changes
none (unbuildable)
Verified recommended fix
if the module is ever revived: memchr NUL + arglen check before use; otherwise delete the file.
Verdict
Dead code - unreachable by construction on this tree. (1) sys/netgraph7/ng_fec.c is commented out of the netgraph7 module SUBDIR (sys/netgraph7/Makefile, '# fec \'), and (2) although conf/files:1704 lists it as 'optional netgraph7_fec', it CANNOT COMPILE: a kernel-compile attempt with options NETGRAPH7_FEC (harness config X86_64_NG7, stock X86_64_GENERIC base + NETGRAPH7 stack) failed with 76 errors - FreeBSD-5-era API usage: 'struct ifaltq_subque declared inside parameter list', 'IFF_DRV_RUNNING undeclared', 'implicit declaration of ifunit', 'IF_AFDATA_LOCK implicit', 'field fec_ch has incomplete type' (full log: ng7build-fecfail.log). This independently reproduces the pass-1 '81-error standalone build' finding. The code defect itself is line-accurate real: rcvmsg (:1287-1294) does 'ifname = msg->data' and passes it to addport/delport with no arglen/NUL validation; ifunit()/kprintf %s walk past the ng_mesg allocation until an incidental zero (same mechanism DEMONSTRATED LIVE on the v1 twin ng_fec.c, see DF-3506 pack: 'AAAAAAAAXXXX' over-read). Root-only control plane; fault/DoS-grade at slab boundaries.
No comments yet.