ng_bt3c_rcvmsg: NGM_BT3C_NODE_GET_QLEN reads msg->data without arglen validation — heap OOB read
Summary
The GET_QLEN handler dereferences ((ng_bt3c_node_qlen_ep *)(msg->data))->queue at :444 with no check that arglen >= sizeof(ng_bt3c_node_qlen_ep). The sibling commands validate (SET_QLEN at :467, SET_DEBUG at :419) but GET_QLEN does not, and the ng7 base layer enforces no cmdlist arglen for binary messages. A binary GET_QLEN with arglen < 1 reads one byte past the kmalloc'd ng_mesg. Requires the 3Com 3CRWB609 PC Card to be attached (node exists only when the driver created it); root-configured graph sends. Value only selects a response branch - no disclosure; panic potential under hardened allocators. Not runnable on the audit guest (no PCMCIA); left untested. Fix: arglen equality check. [VERIFIED pass2: hardware-gated no PCMCIA bt3c; GET_QLEN missing arglen check line-verified vs siblings; compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3512 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 371 B | ↓ raw | |
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| env.txt | — | 309 B | view raw | |
| fix.diff | — | 397 B | view raw | |
| manifest.json | — | 739 B | view raw | |
| run.log | — | 63 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3512 - ng_bt3c GET_QLEN arglen unchecked read
Hardware-gated (3Com 3CRWB609 PC Card). GET_QLEN reads msg->data at :444 with no arglen check while sibling commands validate (:419/:467). Compile-validated in the X86_64_NG7 harness kernel.
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
DF-3512 - VERDICT
status: inconclusive | reproduced: 0 | impact: none | confidence: certain
Hardware-gated, not testable on this guest (node exists only when a 3Com 3CRWB609 PC Card is attached; QEMU provides no PCMCIA bt3c). Line-accurate confirmation: ng_bt3c_rcvmsg's NGM_BT3C_NODE_GET_QLEN handler (ng_bt3c_pccard.c:435-466) reads ((ng_bt3c_node_qlen_ep *)(msg->data))->queue at :444 with NO arglen check, while the sibling SET_QLEN (:467) and SET_DEBUG (:419) both validate - confirmed by source. A binary GET_QLEN with arglen < 1 reads one byte past the kmalloc'd ng_mesg; value only selects a response branch (no disclosure); panic potential only at hardened allocator boundaries. The file compiles in the harness kernel (NETGRAPH7_BLUETOOTH_BT3C) proving fix.diff applies (harness build.log).
Kernel references
- sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:444
- sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:467
Evidence
source excerpt :419/:435-466/:467, harness kernel build (bt3c compiled in)
Recommended fix
add 'if (msg->header.arglen != sizeof(ng_bt3c_node_qlen_ep)) ERROUT(EMSGSIZE);' to GET_QLEN.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
source excerpt :419/:435-466/:467, harness kernel build (bt3c compiled in)
PoC changes
none
Verified recommended fix
add 'if (msg->header.arglen != sizeof(ng_bt3c_node_qlen_ep)) ERROUT(EMSGSIZE);' to GET_QLEN.
Verdict
Hardware-gated, not testable on this guest (node exists only when a 3Com 3CRWB609 PC Card is attached; QEMU provides no PCMCIA bt3c). Line-accurate confirmation: ng_bt3c_rcvmsg's NGM_BT3C_NODE_GET_QLEN handler (ng_bt3c_pccard.c:435-466) reads ((ng_bt3c_node_qlen_ep *)(msg->data))->queue at :444 with NO arglen check, while the sibling SET_QLEN (:467) and SET_DEBUG (:419) both validate - confirmed by source. A binary GET_QLEN with arglen < 1 reads one byte past the kmalloc'd ng_mesg; value only selects a response branch (no disclosure); panic potential only at hardened allocator boundaries. The file compiles in the harness kernel (NETGRAPH7_BLUETOOTH_BT3C) proving fix.diff applies (harness build.log).
No comments yet.