ng_fec_delport (NGM_FEC_DEL_IFACE) frees the portlist entry without releasing the port's multicast list: M_DEVBUF ng_fec_mc structs and ifmultiaddr memberships leak on every add/del cycle
Summary
ng_fec_shutdown cleans each port's fec_mc_head before deleting it, but the direct DEL_IFACE path calls ng_fec_delport which TAILQ_REMOVE+kfree(p) with no cmdmulti cleanup. Every DEL_IFACE leaks all ng_fec_mc nodes (M_DEVBUF) and leaves the driver-level multicast memberships permanently programmed on the member interface. Repeated add/del cycles accumulate kernel memory and hardware mc-filter entries. Distinct from DF-0506 (lockless iteration + kmalloc-failure orphan inside cmdmulti); this is the delport path skipping cleanup entirely. Root-only + unbuildable module (proven). Fix: ng_fec_ether_cmdmulti(ifp, p, 0) before the free. [VERIFIED pass2: dead code see DF-3496; delport-skips-cmdmulti line-accurate]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3497 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 343 B | ↓ raw | |
| VERDICT.md | — | 1.6 KB | ↓ raw | |
| env.txt | — | 309 B | view raw | |
| fix.diff | — | 335 B | view raw | |
| manifest.json | — | 684 B | view raw | |
| ng7build-fecfail.log | — | 1.1 MB | ↓ download | |
| run.log | — | 78 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3497 - ng7 ng_fec DEL_IFACE leaks portlist mc state
Dead code (see DF-3496 pack: unbuildable). Source: delport :505-517 frees the portlist entry without ng_fec_ether_cmdmulti(.., 0); rmnode path :1337 cleans.
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
DF-3497 - VERDICT
status: not_reproduced | reproduced: 0 | impact: none | confidence: likely
Dead code - same construction-blocked status as DF-3496 (module commented out of the ng7 SUBDIR; kernel-compile with options NETGRAPH7_FEC fails with 76 errors, ng7build-fecfail.log). The claimed mechanism is line-accurate in source: ng_fec_shutdown/rmnode clean each port's fec_mc_head via ng_fec_ether_cmdmulti(priv->ifp, p, 0) at ng_fec.c:1337, but the direct DEL_IFACE path calls ng_fec_delport (:505-517) which TAILQ_REMOVE+kfree(p) with no cmdmulti cleanup - every DEL_IFACE leaks that port's ng_fec_mc nodes (M_DEVBUF) and leaves the driver-level multicast memberships programmed on the member. NOTE the v1 twin (DF-3508) was REFUTED because DFly ifioctl never dispatches SIOCADDMULTI to if_ioctl; the ng7 fec cmdmulti mechanism is different (it hooks if_resolvemulti-era SIOCADDMULTI forwarding at :455/:579-581 during addport and ioctl), but since the module cannot be built or loaded on this tree, neither arm is reachable. Root-gated resource leak.
Kernel references
Evidence
ng7build-fecfail.log, source :455/:505-517/:579-581/:1337
Recommended fix
call ng_fec_ether_cmdmulti(priv->ifp, p, 0) before kfree(p) in ng_fec_delport.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ng7build-fecfail.log, source :455/:505-517/:579-581/:1337
PoC changes
none (unbuildable)
Verified recommended fix
call ng_fec_ether_cmdmulti(priv->ifp, p, 0) before kfree(p) in ng_fec_delport.
Verdict
Dead code - same construction-blocked status as DF-3496 (module commented out of the ng7 SUBDIR; kernel-compile with options NETGRAPH7_FEC fails with 76 errors, ng7build-fecfail.log). The claimed mechanism is line-accurate in source: ng_fec_shutdown/rmnode clean each port's fec_mc_head via ng_fec_ether_cmdmulti(priv->ifp, p, 0) at ng_fec.c:1337, but the direct DEL_IFACE path calls ng_fec_delport (:505-517) which TAILQ_REMOVE+kfree(p) with no cmdmulti cleanup - every DEL_IFACE leaks that port's ng_fec_mc nodes (M_DEVBUF) and leaves the driver-level multicast memberships programmed on the member. NOTE the v1 twin (DF-3508) was REFUTED because DFly ifioctl never dispatches SIOCADDMULTI to if_ioctl; the ng7 fec cmdmulti mechanism is different (it hooks if_resolvemulti-era SIOCADDMULTI forwarding at :455/:579-581 during addport and ioctl), but since the module cannot be built or loaded on this tree, neither arm is reachable. Root-gated resource leak.
No comments yet.