DF-3520 — negative-length bcopy amplifier in ng_pptpgre ack processing

Verdict: NOT REPRODUCED in-kernel on this guest (needs the DF-0596 SMP TOCTOU first, which is blocked by the CPU-0 netisr serialization); the arithmetic sink is PROVEN and materially worse than DF-0596's recorded 8-byte OOB write.

status = not_reproduced, reproduced = 0, impact = none (on this vector), confidence = certain (arithmetic + code).

The sink

sys/netgraph/pptpgre/ng_pptpgre.c, ack handler:

:641  const int index = ack - priv->recvAck - 1;
      /* checks: PPTP_SEQ_DIFF(ack, xmitSeq) > 0  -> badAck  (:646)
                 PPTP_SEQ_DIFF(ack, recvAck) <= 0 -> badAck  (:650) */
:668  bcopy(a->timeSent + index + 1, a->timeSent,
          sizeof(*a->timeSent) * (PPTP_XMIT_WIN - (index + 1)));

index is bounded only by the window invariant xmitSeq - recvAck <= xmitWin <= PPTP_XMIT_WIN(16), which the read-check-increment at :490-495 enforces non-atomically (the DF-0596 TOCTOU family: two concurrent xmits both observe diff=15 < 16, both increment → diff = 17). One well-formed ack (ack = xmitSeq) then passes both sanity checks with

index = 17 - 0 - 1 = 16
PPTP_XMIT_WIN - (index + 1) = 16 - 17 = -1
sizeof(pptptime_t) * (-1)    = (size_t)0xFFFFFFFFFFFFFFF8

→ bcopy() of ~2^64 bytes: unbounded OOB read and write → non-recoverable page fault in the kernel (certain panic), plus total corruption of everything after timeSent[] in priv before the fault lands. This is a distinct sink at a distinct line from DF-0596's recorded primitive (the 8-byte OOB write at :514), and it corrects DF-0596's impact ceiling ("~200 bytes remaining in the priv chunk, limited"): with index ≥ 16 the copy length is not 8 bytes — it is effectively infinite. Any xmitSeq-recvAck ≥ 17 (however produced) converts one ordinary ack packet into this.

bcopy_demo.c (run in-guest, run.log) reproduces the exact kernel expression and prints the length:

recvAck=100 xmitSeq=117 ack=117 -> index=16
int length  = PPTP_XMIT_WIN - (index+1) = -1
size_t len  = sizeof(pptptime_t) * (-1) = 0xfffffffffffffff8
kernel timeSent[] = pptptime_t[16] (128 bytes), index 16 is 8 bytes past end

(The --bcopy userspace attempt does not fault because glibc's memcpy end-pointer arithmetic wraps modulo 2^64; the kernel's bcopy walks forward through unmapped memory and faults — either way the observation is the length computation, which is identical in kernel and userspace.)

Reachability

Requires the DF-0596 TOCTOU (or any equivalent window-violation race) first — single-threaded, the invariant holds and index ≤ 15 (recvAck only grows; stale-read analysis in the audit shows the recv-side alone cannot exceed 15). The TOCTOU needs two GRE packets in ng_pptpgre_recv/xmit on two CPUs — blocked from userspace ng_socket by the CPU-0 netisr serialization (DF-0590 §2), open in the ng_ether/SMP VPN-concentrator deployment. The remote peer then only needs to send the ack for the highest outstanding sequence number — cid must be known (legit session peer, or the DF-0596-noted 65536 brute).

Fix

Bounds-check index before use (defense in depth, independent of DF-0596's serialization fix):

--- a/sys/netgraph/pptpgre/ng_pptpgre.c
+++ b/sys/netgraph/pptpgre/ng_pptpgre.c
@@ -649,6 +649,11 @@
        if (PPTP_SEQ_DIFF(ack, priv->recvAck) <= 0)
            goto badAck;        /* ack already timed out */
+       if (ack - priv->recvAck - 1 >= PPTP_XMIT_WIN)
+           goto badAck;        /* window invariant violated */
        priv->recvAck = ack;

plus the per-node serialization fix (DF-0590's recommendation) so the invariant cannot break in the first place.

Files

• bcopy_demo.c, run.log — arithmetic reproduction (in-guest)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)