DF-3553 — netgraph7 ng_tee: two cross-connected tees + left2right entry = constructible forwarding cycle → deterministic kernel panic (DF-3540 class, tee instance)

ng_tee (sys/netgraph7/tee/ng_tee.c) is a bidirectional forwarding node: data in on left → out right (+ dup left2right), data in on right → out left (+ dup right2left), data in on left2right → out left (ng_tee_rcvdata, ng_tee.c:293-331). Cross-connecting two tees (T1.left ↔ T2.left, T1.right ↔ T2.right) therefore closes a packet cycle, and — unlike a bare ng_echo pair, whose single hooks are both consumed by the cycle — the tee's left2right/right2left hooks provide an entry edge: one packet injected into T1.left2right is forwarded out T1.left straight into the loop.

ng7 forwards items synchronously (ng_snd_item() → refs>1 → ng_apply_item() direct call, netgraph/ng_base.c:1948-1961), acquiring the peer node's LWKT token each hop (ng_acquire_read → lwkt_gettoken_shared pushes a tokref into td_toks[LWKT_MAXTOKENS=32]). The tee cycle has no exit, so one injected byte recurses until the token array overflows:

panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken_shared
       at /usr/src/sys/kern/lwkt_token.c:732
lwkt_gettoken_shared() x2
ng_apply_item() x ~31 recursive
Debugger("panic")

This is the same framework defect as DF-3540 (there made reachable through ng_bpf's per-hook ifMatch/ifNotMatch forwarding destinations); this finding demonstrates the pure-topology instance through ng_tee — no node-specific configuration at all, only mkpeer/mkpeer/connect.

Trigger privilege

ROOT ONLY: ng7 control sockets are caps_priv_check-gated (same as v1 / DF-3546's unpriv_check). Severity Low (privileged DoS), consistent with DF-3540/DF-3546.

Build / Run (in-guest, root, stock 6.5-DEVELOPMENT #0 INVARIANTS kernel)

sh build.sh            # builds ng7 netgraph.ko ng_socket.ko ng_tee.ko from
                       # clean /usr/src + compiles tee_cycle (ng7 ABI)
sh run.sh              # loads the ng7 stack, fires the trigger
# EXPECTED (stock): instant panic (see panic.txt / console_full.txt /
#                   ddb_trace.txt); guest sits in DDB, ssh dead.

Fix validation (fix.diff — ng7 core synchronous-forward hop bound)

fix.diff is the core portion of DF-3540's validated fix (identical defect class): a per-item el_hops counter bounds synchronous forwarding at 16 hops; cycles unwind with ELOOP and the packet is dropped. No ng_tee node-level change is possible for this instance (a pure-topology cycle cannot be rejected at newhook without graph knowledge).

fix_status: fixed (baseline reproduced; patched reproduces neither wedge nor panic; normal single-hop forwarding unaffected — the graph build itself exercised mkpeer/connect through the patched core).

Files

tee_cycle.c     trigger (one source; -DNG7 selects ng7 ABI — this finding)
build.sh run.sh exact commands
run.log         stock run: ssh-side output (guest died before the
                background log could be read back; console is decisive)
panic.txt       panic banner from the serial console
console_full.txt full serial console (boot + panic + DDB)
ddb_trace.txt   DDB `trace` captured live through a chardev-change
                serial socket: panic→lwkt_gettoken_shared→ng_apply_item x31
fix1_cycle.log  patched-core run: sendto returns, survives 30s
fix.diff        ng7 core hop bound (el_hops / NG_HOPS_MAX)
env.txt         guest uname / module state

DF-3553 — VERDICT

status: reproduced / impact: panic / confidence: certain fix_status: fixed (baseline panic reproduced; patched core survives)

What was verified, step by step

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, stock INVARIANTS, 2026-07-02 build), QEMU/KVM single-tenant, fresh vm.sh reset with-src before each phase.

1. The graph is constructible (pure topology)

./tee_cycle7 (root), output captured over ssh before the machine died:

tee_cycle: uid=0 core=ng7
STEP mkpeer1 ok        (C.tap <-> T1.left2right   — ENTRY EDGE)
STEP mkpeer2 ok        (T1.right  <-> T2.right)
STEP connect ok        (T1.left   <-> T2.left     — CYCLE)
STEP graph built (tee/tee cycle + tap entry), injecting 1 byte ...

ng7 hook-add order on T1 is left2right, right, left (and right, left on T2), which resolves left.dest=&right / right.dest=&left on both nodes — i.e. the canonical bidirectional tee. One sendto() of a single byte is the whole trigger. No node-specific control message is used (contrast DF-3540, which needed three ng_bpf SET_PROGRAMs).

2. Stock kernel: deterministic panic

The guest died during launch; the serial console (console_full.txt, panic.txt) shows:

panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken_shared
       at /usr/src/sys/kern/lwkt_token.c:732
cpuid = 0
Trace beginning at frame 0xfffff80117ee87f0
lwkt_gettoken_shared() at lwkt_gettoken_shared+0x34c
lwkt_gettoken_shared() at lwkt_gettoken_shared+0x34c
ng_apply_item() at ng_apply_item+0xa9
ng_apply_item() at ng_apply_item+0x105   (x ~30 more)
Debugger("panic")
CPU0 stopping CPUs: 0x0000003e
db>

Captured live via the QEMU monitor as well (chardev-change of the serial to a socket, then DDB trace over that socket — ddb_trace.txt):

Debugger() at Debugger+0x7c
panic() at panic+0x24e
lwkt_gettoken_shared() at lwkt_gettoken_shared+0x34c
ng_apply_item() at ng_apply_item+0xa9
ng_apply_item() at ng_apply_item+0x105    x 31
ngthread() at ngthread+0x18

Identical signature to DF-3540 (ng_bpf instance): each synchronous forward pushes a tokref; LWKT_MAXTOKENS=32; KKASSERT trips. The recursion rides the cpu0 ngthread (ng_snd_item queues first-entry items to ng_cpuport(0), ng_base.c:1948-1956).

3. Source trace

• sys/netgraph7/tee/ng_tee.c:293-331 — ng_tee_rcvdata: in→dest(+dup) forwarding; no cycle knowledge. T1: left2right-in → out left (via newhook-wired dest, ng_tee.c:186); left-in → out right; right-in → out left.
• sys/netgraph7/tee/ng_tee.c:169-205 — ng_tee_newhook precalcutes dest/dup; with hook-add order left2right,right,left (T1) and right,left (T2) both tees end up left↔right bidirectional.
• sys/netgraph7/netgraph/ng_base.c:1908-1965 — ng_snd_item: forwarded items (refs>1) applied synchronously → unbounded recursion.
• sys/netgraph7/netgraph/ng_base.c:1996-1999 — ng_acquire_read → lwkt_gettoken_shared → td_toks[] overflow at 32 (sys/kern/lwkt_token.c:732).

4. Fix validation (fix.diff)

fix.diff = the ng7 CORE portion of DF-3540's validated two-layer fix (an el_hops counter on the item + NG_HOPS_MAX 16 bound in ng_snd_item), because the correct layer for a pure-topology cycle is the core: ng_tee itself cannot detect the cycle at newhook/connect time without graph-wide knowledge.

Applied to the guest's /usr/src copy only; ng7 modules rebuilt with -Werror (clean); never applied to the audit tree.

The patched run also re-executed all three graph-construction control messages through the patched core (mkpeer/mkpeer/connect all OK), so normal message handling is intact; only the unbounded recursion is gone (cycle unwinds at depth 16, item dropped with ELOOP on the ngthread).

Exploit ceiling

None beyond denial of service: root-gated configuration, deterministic panic behind an always-on KKASSERT tripwire; no memory-safety violation and no controlled overwrite occurs before the panic. Same ceiling as DF-3540/DF-3546. (netgraph socket creation is caps_priv_check-gated; uid 1001 cannot even open the control socket — verified for the identical gate in DF-3546's unpriv_check.txt.)

Notes

• The stock-run trigger's own stdout log was lost with the guest (death was immediate); the ssh-side transcript (kldstat + LAUNCH + step output shown above) and the console capture are the decisive records.
• Terminal state of the ng7 instance is a clean panic + DDB (unlike the v1 twin DF-3554, whose terminal state varies — see that pack).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.