DF-3550 evidence pack — v1 ng_sample downstream reflection (DF-3545 twin)

sys/netgraph/ng_sample.c (v1 netgraph template, node type "sample"): downstream_hook.dlci is never initialized to the -1 sentinel — the constructor M_ZEROs the whole private struct (ng_sample.c:155) and only the 16 DLCI channels get explicit values (:158-161), while ng_xxx_newhook()'s downstream branch (:233-237) stores the hook pointer but never sets dlci = -1. Data arriving on sample:downstream therefore has dlci == 0, takes the dlci != -1 "from a DLCI channel" branch in ng_xxx_rcvdataq() (:355) and is forwarded straight back out downstream_hook.hook (:362-364) — i.e. reflected to the sender — while the intended decode/demux branch (:365-375) is dead code.

This is the v1 twin of DF-3545 (ng7 ng_sample), verified live here for the first time against the stock v1 netgraph stack.

Build

See build.sh — builds ng_sample.klo from /usr/src/sys/netgraph and compiles v1demo. Module build log: build.log (RC=0, -Werror).

Run

See run.sh — loads ng_socket.ko + ng_sample.ko, then v1demo reflect.

Expected

RECEIVED 4 bytes back: 'PING'
RESULT: REFLECTED
GET_STATUS: packets_in=0 packets_out=1

packets_in=0 / packets_out=1 proves the frame was misclassified as DLCI egress traffic (dead decode branch) instead of counted as demux input.

Contents

• v1demo.c v1-ABI driver (raw AF_NETGRAPH sockets; NG_VERSION 2, 52-byte ng_mesg header, libnetgraph-style data-socket association via NGM_NODEINFO + connect("[id]:"))
• build.log module build (-Werror, RC=0)
• run.log decisive run (reflection + leak + hooktest sections)
• env.txt guest uname / compiler / module state
• fix.diff one-line sentinel fix

DF-3550 — VERDICT: REPRODUCED (v1 twin of DF-3545)

Impact: none (misroute/reflection in a dormant template node) Confidence: certain

What was run

v1demo reflect on the stock v1 netgraph stack (guest boots netgraph.ko v1; ng_socket.ko + freshly built ng_sample.ko loaded as root). The demo speaks the v1 ABI natively (NG_VERSION 2, 52-byte struct ng_mesg header, NGM_NODEINFO + connect("[id]:") data-socket association exactly like libnetgraph's NgMkSockNode), builds the graph socket(sd) <-> sample(downstream) via NGM_MKPEER, writes "PING" out sd, and polls the data socket for a reply.

Observed (run.log)

RECEIVED 4 bytes back: 'PING'
RESULT: REFLECTED
GET_STATUS: packets_in=0 packets_out=1

The frame written into sample:downstream came straight back out the same hook, and NGM_XXX_GET_STATUS reports packets_out=1 / packets_in=0 — the demux branch never ran.

Why (kernel path, line-by-line)

1. ng_xxx_constructor() M_ZEROs the whole struct XXX (sys/netgraph/ng_sample.c:155) and then initializes only the 16 DLCI channels (:158-161). downstream_hook.dlci stays 0.
2. ng_xxx_newhook()'s downstream branch (:233-237) stores the hook pointer and private pointer but never sets the -1 sentinel documented at :118 (int dlci; /* -1 == downstream */).
3. Data arriving on the downstream hook: ng_xxx_rcvdata() reads dlci = hookinfo->dlci == 0 (:333), ng_xxx_rcvdataq() takes the dlci != -1 "received on a DLCI hook" branch (:355) and forwards the frame back out xxxp->downstream_hook.hook (:362-364) — the very hook it arrived on → reflection to the sender, packets_out++.
4. The intended decode branch (:365-375) is unreachable dead code.

Module state: ng_sample.ko builds from /usr/src (-Werror, RC=0, build.log) but does not ship (no SUBDIR entry in sys/netgraph/Makefile, no sys/conf/files line, absent from /boot/kernel). Instantiating a sample node requires root (v1 control sockets are caps_priv_check gated, sys/netgraph/socket/ng_socket.c:172) plus an explicit kldload.

Exploit chain

None — dormant template, misroute/reflection only, no memory-safety impact. (An administrator who wires sample:downstream to a real interface hook would create a packet-reflection loop, but that already requires root.)

Fix validation

fix.diff adds the one-line sentinel (xxxp->downstream_hook.dlci = -1; in the newhook downstream branch). Kernel-rebuild validation skipped per contract for Info-severity findings (mirrors DF-3545's treatment of the ng7 twin); the patch is a trivially auditable initialization fix.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.