ng_fec_addport has no cross-bundle exclusivity: a second fec node can re-enslave an already-bundled interface, saving fec_if_input=ng_fec_input and clobbering IFP2NG — after either node's teardown the member is left with if_input=ng_fec_input over a NULL/freed IFP2NG (permanent RX blackhole or freed-node deref on every frame)
Summary
The duplicate check only scans THIS bundle's ports. Nothing stops interface fxp0 being added to fec0 and then fec1: the second addport overwrites IFP2NG(fxp0) and saves new->fec_if_input = bifp->if_input which is now ALREADY ng_fec_input from the first bundle. Whichever node tears down second restores if_input = ng_fec_input with IFP2NG either NULL or pointing at its about-to-be-freed node - every subsequent frame calls ng_fec_input which dereferences IFP2NG and NG_NODE_PRIVATE on a NULL or freed ng_node: hard RX blackhole in the benign case, freed-node deref in the worst case. New mechanism distinct from DF-0503 (single-bundle stored-ifp lifetime). Root-only + unbuildable module (proven). Fix: reject interfaces whose if_input is already ng_fec_input or whose IFP2NG is non-NULL. [VERIFIED pass2: dead code see DF-3496; cross-bundle twin demonstrated live on v1 DF-3507]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3498 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 330 B | ↓ raw | |
| VERDICT.md | — | 1.6 KB | ↓ raw | |
| env.txt | — | 309 B | view raw | |
| fix.diff | — | 392 B | view raw | |
| manifest.json | — | 685 B | view raw | |
| ng7build-fecfail.log | — | 1.1 MB | ↓ download | |
| run.log | — | 78 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-3498 - ng7 ng_fec cross-bundle enslavement
Dead code (see DF-3496 pack: unbuildable). Mechanism twin demonstrated live on v1 - see ../DF-3507/ (FECDMP cross-enslave + stale ac_netgraph evidence).
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
DF-3498 - VERDICT
status: not_reproduced | reproduced: 0 | impact: none | confidence: likely
Dead code - unbuildable on this tree (module SUBDIR commented out; NETGRAPH7_FEC kernel compile fails with 76 errors - ng7build-fecfail.log; see DF-3496). The cross-bundle enslavement claim is line-accurate in source: the duplicate check at ng_fec.c:382-389 only scans THIS bundle's ports, addport then overwrites IFP2NG(bifp) (:417-419) and saves new->fec_if_input = bifp->if_input which is ALREADY ng_fec_input from the first bundle (:437-446), and delport (:505) restores if_input = p->fec_if_input = ng_fec_input with IFP2NG NULLed - leaving every subsequent RX frame calling ng_fec_input over a NULL/freed node (RX blackhole or freed-node deref). The MECHANISM was demonstrated live on the buildable v1 twin (DF-3507 pack: cross-enslave ac_netgraph switch + stale pointer after delport, FECDMP evidence). ng7 arm unreachable: cannot build. Root-gated misconfiguration-turned-DoS.
Kernel references
- sys/netgraph7/ng_fec.c:382
- sys/netgraph7/ng_fec.c:418
- sys/netgraph7/ng_fec.c:441
- sys/netgraph7/ng_fec.c:505
Evidence
ng7build-fecfail.log, source :382-446/:505-509, DF-3507 twin runtime demonstration
Recommended fix
reject members whose if_input is already ng_fec_input or whose IFP2NG is non-NULL.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ng7build-fecfail.log, source :382-446/:505-509, DF-3507 twin runtime demonstration
PoC changes
none (unbuildable)
Verified recommended fix
reject members whose if_input is already ng_fec_input or whose IFP2NG is non-NULL.
Verdict
Dead code - unbuildable on this tree (module SUBDIR commented out; NETGRAPH7_FEC kernel compile fails with 76 errors - ng7build-fecfail.log; see DF-3496). The cross-bundle enslavement claim is line-accurate in source: the duplicate check at ng_fec.c:382-389 only scans THIS bundle's ports, addport then overwrites IFP2NG(bifp) (:417-419) and saves new->fec_if_input = bifp->if_input which is ALREADY ng_fec_input from the first bundle (:437-446), and delport (:505) restores if_input = p->fec_if_input = ng_fec_input with IFP2NG NULLed - leaving every subsequent RX frame calling ng_fec_input over a NULL/freed node (RX blackhole or freed-node deref). The MECHANISM was demonstrated live on the buildable v1 twin (DF-3507 pack: cross-enslave ac_netgraph switch + stale pointer after delport, FECDMP evidence). ng7 arm unreachable: cannot build. Root-gated misconfiguration-turned-DoS.
No comments yet.