DF-3523 — VERDICT

Status: reproduced (stock kernel). Impact: dos — permanent, unprivileged, unbounded kernel-memory leak (one struct ng_item + one node reference + one hook reference per cancelled armed pptpgre timer); at ~30k cycles the objcache(netgraph) exhausts and the leaked node refs drive the known DF-3514 idhash-rehash kernel panic (observed in this run, panic.txt). Fix validated (two layers, kernel #1 + ng7 module rebuild): identical workload -> leak count flat (3).

Root cause (certain; TWO stacked defects)

ng7 ng_callout() (ng_base.c:3248-3268) parks an ng_item holding NG_NODE_REF + NG_HOOK_REF as the callout argument. ng_uncallout() (ng_base.c:3273-3296) frees it only inside if (rval > 0), and even then only via NG_FREE_ITEM(item).

1. Layer 1 — DF-3515 contract violation (stock kernel): callout_stop() of an ARMED, not-yet-fired callout returns 0 (kern_timeout.c _callout_update_spinlocked CALLOUT_STOP branch unloads the callout without setting CALLOUT_PREVENTED; _callout_cancel_or_stop then early-exits return 0 at :888-891). callout_cancel() has the same early-exit (verified experimentally: swapping stop->cancel did not fix anything). So on stock, the cleanup is never reached.
2. Layer 2 — ng7 port defect (any kernel): NG_FREE_ITEM in netgraph7 is a flag-only macro (netgraph.h:817-820; the same defect DF-3513 found in NG_BT_ITEMQ_DRAIN). The real destructor is ng_free_item() (reached via ng_unref_item, netgraph2.h:77-94); the callout-arg item has refs==0 (born zeroed, never sent), so the correct release is ng_free_item(item) directly. Measured: with ONLY layer 1 fixed (kernel #1, stock ng_base), 30k cycles still leaked 5.76K allocs / 830 KB — identical to stock.

Consumer sites in ng_pptpgre.c (all normal-operation): reset via every NGM_PPTPGRE_SET_CONFIG (:396 -> :968-969), ack processing (:770), piggy-backed ack in xmit (:596), session-hook disconnect (:494).

Verification narrative

1. Stock kernel (X86_64_GENERIC #0), modules built in-guest, harness pptp_leak.c wires ng_socket -> pptpgre:upper + session_0000 and then runs the whole attack loop as uid 65534 (ng7 data sockets carry no privilege check): 30k arm/cancel cycles (SET_CONFIG -> 1-byte data write arms rackTimer -> SET_CONFIG cancels it) -> vmstat -m netgraph zone InUse 4 -> 5.76K / 830 KB, never returns (run.log).
2. Persistence: kldunload ng_pptpgre -> Device busy (leaked node refs pin the module); a later NGM_NAME pptp0 -> Address already in use (the dead node's name stays registered — ng_unref_node only unlists at last ref).
3. Escalation observed: after the 30k leak, the next netgraph control-socket creation panicked the kernel via the DF-3514 sink: Warning: objcache(netgraph) exhausted on cpu0! -> panic: hashdestroy: hash not empty (ngc_attach -> ng_make_node_common), guest down (panic.txt).
4. CONTROL (fresh boot, identical code path, enableWindowing=0 so the rack timer is never armed): 30k cycles -> Count 3 -> 3 flat.
5. Fix validation: kern_timeout.c fix applied in-guest (kernel #1, make nativekernel RC=0) + ng_free_item(item) added to ng_uncallout (module rebuild). 30k cycles -> Count flat at 3 (vs 5.76K). Intermediate step (kernel #1 + STOCK ng_base) measured 5.76K again — proving both layers are necessary.

Exploit chain / impact ceiling

Pure leak/DoS primitive (no corruption): ~0.5 KB of unreclaimable kernel memory per cancelled timer from an unprivileged local user, plus permanent module pinning and node-name squatting; at scale it crosses into the DF-3514 rehash panic (observed). No route to uid=0 — the leaked items are never dereferenced after their flag is set.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.