DF-3525 VERDICT — reproduced (on the DF-3524-un-gated kernel); fix validated

Status: REPRODUCED. Impact: leak — kernel-heap over-read at the Bluetooth driver TX boundary (DF-0508's verified ng_ubt usbd_m_copy_in sink): an unauthenticated radio-range peer (or any local user able to write to a data socket wired to an l2cap node's hci hook — no privilege check) can make the stack transmit up to ~65 KB of adjacent kernel heap per request, repeatable. Fix validated at module level.

Root cause (certain)

ng_l2cap_lp_receive (ng_l2cap_llpi.c:600-732) never validates the ACL header's length field (u_int16_t, fully attacker-controlled) against the bytes actually present in the mbuf:

:690 con->rx_pkt_len = le16toh(l2cap_hdr->length) + sizeof(hdr); :701 m_cat(con->rx_pkt, m); / DF m_cat does NOT touch m_pkthdr.len / :702 con->rx_pkt->m_pkthdr.len += length; / the CLAIM is added / :711 con->rx_pkt_len -= length;

Construction (l2cap_con.c, mode lie): START fragment carrying 8 real bytes (L2CAP hdr length=65523 + cmd hdr) with a truthful claim of 8; then ONE FRAGMENT carrying ZERO payload bytes claiming 65519. Claims sum to L+4 exactly -> rx_pkt_len == 0 -> "complete" packet with m_pkthdr.len = 65527 and 8 real bytes. ng_l2cap_receive's consistency check (hdr->length == m_pkthdr.len - 4) passes by construction. ng_l2cap_process_echo_req (evnt.c:969-1003) re-uses the lying mbuf and ng_l2cap_lp_send (:510,:548) writes the lie into the outgoing ACL header.

In-guest observable (no radio): the ECHO_RSP ACL packet received on the forged hci hook carries ACL length = 65527 with 9 real payload bytes (= 65519 phantom bytes, exactly the constructed lie). On real hardware the driver TX reads the phantom bytes off the end of the 12-byte chain -> heap disclosure over the air (DF-0508 sink; DF-0508 itself proved this sink for a sibling pkthdr.len lie in the config-echo path).

The data path (ng_l2cap_l2ca_receive, ulpi.c:882-957) forwards lying mbufs upstream with no actual-length check either (same primitive, different sink).

Gating (documented)

On the STOCK kernel no con can reach CON_OPEN (DF-3524 wedge), so this entry is dormant until DF-3515/DF-3524 are fixed. The demo therefore ran on kernel #1 (kern_timeout fix) with the STOCK ng_l2cap module. This is the standard "fix un-gates the next bug" pattern; both findings ship together.

Fix validation (module level)

if (length > m->m_pkthdr.len) { error = EMSGSIZE; goto drop; } after the length field is parsed (fix.diff). Rebuilt ng_l2cap.ko in-guest: ./l2cap_con lie -> ECHO_RSP NOT RECEIVED (lie suppressed) ./l2cap_con con -> ECHO_RSP received, exit 0 (truthful path intact) Kernel log confirms the truthful flow (length=12 == actual).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.