DF-3546 — netgraph (v1) ng_bpf: cyclic ifMatch/ifNotMatch forwarding → unbounded synchronous recursion → kernel stack exhaustion (panic)

v1 twin of DF-3540 (ng7). ng_bpf_setprog() (sys/netgraph/bpf/ng_bpf.c:474-496) resolves ifMatch/ifNotMatch as hook names on the same node with no check that the target differs from thisHook and no cycle detection, and v1 netgraph forwards synchronously — NG_SEND_DATA (ng_bpf.c:431) → ng_send_data() (sys/netgraph/netgraph/ng_base.c:1678-1698) calls the peer's rcvdata directly in the same thread, with no hop bound and no LWKT token acquisition (v1 core uses only crit_enter()). A cyclic configuration makes one injected packet recurse until the kernel thread's kstack guard page is hit:

DOUBLE FAULT - KERNEL STACK GUARD HIT!
Fatal double fault
rip = 0xffffffff82656970          <- ng_bpf.ko (ng_bpf_rcvdata)
rsp = 0xfffff8008d1f6000
panic: double fault               (verified on both cycle modes)

Unlike ng7 (DF-3540, token-array KKASSERT at 32 hops), v1 has no tripwire at all — the recursion simply runs the kstack off the end; the guard-page double fault is the only stop.

Trigger privilege

ROOT ONLY (verified live): v1 control sockets require caps_priv_check(SYSCAP_RESTRICTEDROOT|__SYSCAP_NULLCRED) (sys/netgraph/socket/ng_socket.c:172-174); uid 1001 gets errno 43 (EPROTONOSUPPORT) on socket(AF_NETGRAPH, ..., NG_CONTROL) (unpriv_check.txt). Root must build the cyclic graph; one packet (root-injected, or any traffic source once configured) panics the machine. Severity Low (privileged DoS), same class as DF-3540.

Modes (ng_cycle_v1.c)

self : two ng_bpf nodes, B1.x1 <-> B2.y1, both progs ifMatch == thisHook ("echo on arrival hook" is what keeps the packet in the pair); injection via B1.x2. cross : three-hook cycle with NO self-reference at all (B1.e -ifMatch-> B1.p <-> B2.q -ifMatch-> B2.s <-> B1.r -ifMatch-> B1.p ...), proving the cycle class, not just self.

Build / Run (in-guest, root, stock 6.5-DEVELOPMENT #0 INVARIANTS)

sh build.sh     # cc -O2 -o /root/ng_cycle_v1 /root/ng_cycle_v1.c
sh run.sh self  # expect: DOUBLE FAULT - KERNEL STACK GUARD HIT, guest down
# after vm.sh reset with-src:
sh run.sh cross # expect: same panic

Fix validation (fix.diff)

stock           self -> panic        cross -> panic
patched module  self -> EINVAL (ifMatch==thisHook rejected)
                cross -> sendto errno 62 (ELOOP, depth bound 16), survives

Patch applied to the guest's /usr/src copy only; module rebuilt with -Werror (fix_build.log); never applied to the audit tree.

Files

ng_cycle_v1.c     trigger (v1 NG_VERSION 2 ABI, sync control msgs)
build.sh run.sh   exact commands
build.log         compiler output (trigger)
run.self.log      decisive stock run (self): panic
run.cross.log     stock cross run (ssh output lost when guest died)
console_self.txt  serial console: boot + DOUBLE FAULT (self)
console_cross_tail.txt / console_full.txt  serial console (cross)
panic.txt         panic signature
unpriv_check.txt  uid 1001 -> errno 43 on control socket
fix.diff          two-part fix (thisHook guard + depth bound)
fix_build.log     patched module build (-Werror clean)
fix1_self.log     patched: self -> SET_PROGRAM EINVAL, survives
fix2_cross.log    patched: cross -> ELOOP drop, survives 30s
env.txt           guest uname / kernel

DF-3546 — VERDICT

status: reproduced / impact: panic / confidence: certain

What was verified, step by step

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, stock INVARIANTS, 2026-07-02 build), QEMU/KVM single-tenant, fresh vm.sh reset with-src before each decisive run.

Baseline (stock kernel + stock /boot/kernel modules)

1. kldload netgraph ng_socket ng_bpf (v1 modules).

2. ./ng_cycle_v1 self (root): * graph built: socket node bpcyc — in ↔ B1.x2; B1.x1 ↔ B2.y1; SET_PROGRAM B1: x2→x1, x1→x1; B2: y1→y1 (all accepted, stock has no thisHook guard). * 1-byte sendto on the data socket never returns — the ssh session dies with the guest. Serial console (console_self.txt, panic.txt):

    DOUBLE FAULT - KERNEL STACK GUARD HIT!
    Fatal double fault
    rip = 0xffffffff82656970    <- ng_bpf.ko base 0xffffffff82656000
    rsp = 0xfffff8008d1f6000
    panic: double fault
   

   rip is inside ng_bpf.ko (+0x970 = ng_bpf_rcvdata); rsp sits exactly at the kstack guard boundary. The recursion is: ngd_send → NG_SEND_DATA → ng_send_data (ng_base.c:1687 calls (*rcvdata)(hook->peer, m, meta) directly, same thread) → ng_bpf_rcvdata → NG_SEND_DATA → … with no bound anywhere in v1. 3. vm.sh reset with-src, then ./ng_cycle_v1 cross (root): identical DOUBLE FAULT at the identical rip after a clean boot (console_cross_tail.txt, console_full.txt) — the no-self-reference 3-hook cycle class panics too. (First cross attempt failed with ENOENT from a path bug in my trigger — con.path must be relative to the addressed node ("p"), not socket-relative ("in.p"); fixed.)

Unprivileged reachability

uid 1001 running the same trigger: socket(AF_NETGRAPH, …, NG_CONTROL) fails with errno 43 (EPROTONOSUPPORT) — v1 ngc_attach gates socket creation on caps_priv_check(SYSCAP_RESTRICTEDROOT|__SYSCAP_NULLCRED) (sys/netgraph/socket/ng_socket.c:172-174). The trigger is root-only; severity capped at Low (privileged DoS), consistent with DF-3540.

Fix validation (fix.diff, applied to the guest's /usr/src copy only)

• Part 1 — ng_bpf_setprog() rejects non-empty ifMatch/ifNotMatch equal to thisHook (forwarding out the arrival hook is always a cycle; the empty default program still passes).
• Part 2 — ng_bpf_rcvdata() bounds nested synchronous forwarding at 16 hops with an atomic depth counter decremented after the forward (so pure cycles stay nested and trip the bound; unwinding is clean).

Module rebuilt in-guest with -Werror (fix_build.log, clean), loaded from /usr/src/sys/netgraph/bpf/ng_bpf.ko:

fix_status: fixed (baseline reproduced both modes; patched reproduces neither; per-hop filter/forward behavior intact — the ELOOP run exercised 16 full match+forward hops).

Why this is a real v1 finding and not a DF-3540 duplicate

DF-3540 was filed against sys/netgraph7/bpf/ng_bpf.c (itemized ng7 core, per-node tokens → token-array KKASSERT overflow). This finding is the v1 twin: sys/netgraph/bpf/ng_bpf.c on the v1 core (sys/netgraph/netgraph/), which has no items, no tokens and no hop accounting — the failure mode is plain kstack exhaustion (guard-page double fault), verified on this guest's stock v1 modules.

Exploit ceiling

Write-capable? No — this is pure recursion depth (no memory overwrite before the guard page). The guard-page double fault makes it a clean privileged DoS; there is no path to uid=0 (and the trigger itself requires root).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.