DF-3518 — ng_pptpgre priv UAF: rmnode free vs in-flight rcvdata

Verdict: NOT REPRODUCED on this guest — code-confirmed UAF whose trigger vector is blocked by the same CPU-0 netisr serialization that DF-0590 established empirically (millions of frames, no concurrency).

status = not_reproduced, reproduced = 0, impact = none (on this vector), confidence = certain (code-level).

The defect (code trace)

v1 netgraph delivers data inline, with no node reference and no lock across the call:

• sys/netgraph/netgraph/ng_base.c:1687 — ng_send_data(): error = (*rcvdata)(hook->peer, m, meta); — direct call, caller keeps no ref on the peer node and none exists on node->private.
• sys/netgraph/pptpgre/ng_pptpgre.c:437-440 — ng_pptpgre_rmnode(): after ng_pptpgre_reset() sync-stops both timers, if (priv->timers == 0) { kfree(priv, M_NETGRAPH); node->private = NULL; }.

Nothing pins priv for the duration of an in-flight rcvdata / rcvmsg. On an SMP system where a peer node dispatches into the pptpgre node on CPU A (e.g. ng_ether delivering from ether_input's per-flow netisr, sys/net/if_ethersubr.c:1189), a concurrent teardown on CPU B (last-hook disconnect → ng_rmnode → ng_pptpgre_rmnode → kfree(priv)) frees the ~208-byte priv while CPU A is still writing priv->stats (:576-577, :551-552), priv->recvSeq/xmitSeq (:698, :516), priv->conf reads, etc. → use-after-free write of controlled-ish data on the M_NETGRAPH heap. This is the pptpgre instantiation of the "node private data" half of DF-0492 (L2TP) — not covered by DF-0596, which is scoped to the xmitWin/timeSent[] state race.

Aggravator (post-free, not pre-free): with DF-3521's leak, priv->timers never reaches 0, so rmnode doesn't free — the UAF window needs a clean-timers shutdown (e.g. node with no armed timers, or a kernel with the kern_timeout contract fixed).

Why it cannot fire from userspace on this guest

Every ng_socket send (data and control) is processed on CPU 0's netisr port: sys/kern/uipc_socket.c:254-259 (no PR_SYNC_PORT, no pr_initport for ng_socket → so->so_port = netisr_cpuport(0)), and the callouts arm on the CPU that starts them. DF-0590's pack demonstrated 1–3 M injected frames with zero concurrency — the identical blocker. uaf_hammer here reproduces that negative for the pptpgre rmnode path:

hammer 30 s: injector floods pptp:upper while killer builds+shuts down nodes
DONE inj_sent=9 (ENOBUFS backpressure) kill_cycles=51962 kill_fail=0
EXIT_OK, guest up, vmstat -m netgraph Count unchanged

52k create/config/shutdown lifecycles overlapped with in-flight frames, zero panics — consistent with full serialization on CPU 0.

Realistic exposure

A root-configured PPTP/VPN concentrator with ng_ether- or ng_ksocket-fed lower hooks receives frames on per-flow CPUs — the rmnode-vs-rcvdata window is genuinely open there. Fix (same as DF-0590's): per-node serialization for v1 ng_pptpgre (lockmgr LK_* around rcvdata/rcvmsg/shutdown, or take a node ref + flag across the inline dispatch in ng_send_data).

Files

• uaf_hammer.c — hammer (root): cc -O2 -lpthread -o uaf_hammer uaf_hammer.c
• run.log — full 30 s run output

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)