DF-3557 -- netgraph7 ng_UI: closed UI<->UI cycle + NGM_FLOW_COOKIE relay

Root cause

ng_UI_rcvmsg() (sys/netgraph7/UI/ng_UI.c:138-161) relays NGM_FLOW_COOKIE control messages between its two hooks with NG_FWD_ITEM_HOOK and no bound on nesting. The ng7 core applies forwarded items synchronously (ng_snd_item(): items with refs>1 go straight to ng_apply_item, netgraph/ng_base.c:1961), so a closed hook cycle relays forever, pushing one LWKT tokref per hop into the fixed td_toks_array[32] until lwkt_gettoken() trips its always-on KKASSERT.

A pure-UI cycle IS constructible even though a UI node has only two hooks (both consumed by the loop, leaving no data-injection port):

• two UI nodes wired U0.upstream<->U1.downstream and U1.upstream<->U0.downstream (4 generic messages: mkpeer, mkpeer, rmhook, connect), and
• injection through the CONTROL channel: a FLOW-cookie message sent to the path "u0:downstream" is delivered by ng_address_path() WITH el_hook set (netgraph/ng_base.c:3083-3105 -- hook-addressed delivery does not consume the wire), so ng_UI_rcvmsg() sees lasthook != NULL and starts the relay. The data socket cannot inject (it only addresses hooks of its own node, socket/ng_socket.c:466), and v1 netgraph has no hook-addressed control delivery at all -- this is ng7+ng_UI specific.

Trigger: ui_cycle.c (AF_NETGRAPH control socket only, no data socket needed). Build: build.sh. Run: run.sh.

Expected output (stock kernel): STEP connect U1.upstream<->U0.downstream -- RING CLOSED STEP injecting FLOW message to u0:downstream ... Serial console shows: panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken at /usr/src/sys/kern/lwkt_token.c:661 ng_apply_item() x3+ recursive Debugger("panic") (panic.txt, console_full.txt)

Reachability: root-only. uid 1001 gets EPERM at socket() creation (ngc_attach caps_priv_check) -- unpriv_check.txt.

Fix (fix.diff): nesting counter bound (8) around the relay in ng_UI_rcvmsg(); pure cycles stay nested and trip ELOOP. Validated: patched module -> sendto returns errno 62 (ELOOP), guest survives repeated injections (fix_run.log); stock -> panic (run.log).

DF-3557 — VERDICT

Status: reproduced. Impact: panic (kernel DoS, root-gated). Confidence: certain.

What was verified

Guest: DragonFly 6.5-DEVELOPMENT #0 (stock INVARIANTS kernel, 2026-07-02 build), QEMU/KVM single-tenant, fresh vm.sh reset with-src before the decisive runs. ng7 stack (netgraph.ko, ng_socket.ko, ng_UI.ko) built from the guest's clean /usr/src with -Werror (build via build.sh).

Baseline (stock) — deterministic panic

Trigger ui_cycle.c (control socket only, no data socket needed):

1. control socket node named "uicyc" (NGM_NAME);
2. mkpeer UI → S.a ↔ U0.downstream; name U0 "u0";
3. mkpeer UI from U0 → U0.upstream ↔ U1.downstream; name U1 "u1";
4. rmhook uicyc:a — U0 survives with one hook (a UI node only self-destructs at zero hooks, ng_UI.c:241-244);
5. connect (addressed to "u1:", path "downstream" resolves to U0 through the wire): U1.upstream ↔ U0.downstream — closed 2-cycle;
6. inject one NGM_FLOW_COOKIE (851672669) message addressed to "u0:downstream".

Result: sendto() never returns; the ssh session dies with the guest. Serial console (panic.txt, console_full.txt):

panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken
       at /usr/src/sys/kern/lwkt_token.c:661
lwkt_gettoken() x2, ng_apply_item() x3+ recursive
Debugger("panic")

Why it happens (source trace)

• ng_UI_rcvmsg() — sys/netgraph7/UI/ng_UI.c:145-157 — relays any NGM_FLOW_COOKIE message that arrives with lasthook set: downlink→uplink, uplink→downlink, via NG_FWD_ITEM_HOOK (ng_UI.c:148, 153). No hop/nesting bound; cmd field is never examined.
• Injection channel: ngc_send() (socket/ng_socket.c:301-306) uses ng_address_path(), which for a hook-terminated path sets the item's el_hook (netgraph/ng_base.c:3100-3103). Hook-addressed delivery does not consume the wire, so it reaches nodes whose every hook is already part of the loop. ng_path2noderef() walks through hooks and returns lasthook = peer of the final hook (ng_base.c:1804-1806), so "u0:downstream" is delivered to the node across the wire — inside the ring either way.
• Each relay re-addresses via ng_address_hook() (ng_base.c:3051-3080) to the peer of the target hook = the other node's cycle hook; ng_snd_item() applies forwarded items synchronously (refs>1 → ng_apply_item, ng_base.c:1948-1961), and ng_acquire_read/ writer pushes one LWKT tokref per hop into td_toks_array[32] (sys/sys/thread.h; KKASSERT at lwkt_token.c:661/732 always compiled).
• Topology is constructible because neither ng_con_nodes() (ng_base.c:1442-1485) nor the v1 twin ng_con_nodes() (v1 ng_base.c:975-988) rejects same-graph cycles, and ng_UI_newhook() grants both hooks unconditionally (ng_UI.c:117-132).
• The data path cannot be the entry: the data socket only addresses hooks of its own node (socket/ng_socket.c:466), and a closed UI cycle has no spare hook. The control relay is the enabling ng_UI code — that is what makes this a finding on this file (DF-3540 class, ng_UI instance).

This is the same framework property as DF-3540 (ng_bpf) / DF-3553 (ng_tee), but a distinct constructible instance: no bpf programs, no tee, two stock UI nodes and one FLOW message.

Unprivileged reachability

uid 1001 running the same trigger: socket(AF_NETGRAPH, …, NG_CONTROL) fails with errno 1 (EPERM) — ng7 ngc_attach gates socket creation via caps_priv_check (unpriv_check.txt). Root-only trigger; severity Low (privileged DoS), consistent with DF-3540/3553.

Exploit chain

None beyond denial of service: root-gated configuration, deterministic panic. No memory-safety violation — the tripwire is an always-on KKASSERT; no controlled overwrite occurs before it. No path to uid=0 (and the trigger itself requires root).

Fix validation (fix.diff, applied to the guest's /usr/src copy only)

fix.diff bounds nested synchronous FLOW relaying in ng_UI_rcvmsg() with an atomic nesting counter (NG_UI_FLOW_HOPS_MAX = 8): pure cycles stay nested for the whole relay, so the counter trips deterministically; every exit path decrements. Rebuilt ng_UI.ko alone (-Werror clean), swapped in over the stock module:

fix_status: fixed (baseline reproduced; patched reproduces neither the panic nor the hang; the ELOOP return exercises 8 full relay hops).

v1 twin — why there is NO v1 finding (negative result)

sys/netgraph/UI/ng_UI.c cannot participate in a self-contained cycle:

• v1 ng_UI_rcvmsg() (v1 ng_UI.c:149-154) frees every message and returns EINVAL — no relay, so no control-message cycle.
• v1 control delivery carries no hook (v1 ngc_send discards it; the v1 rcvmsg signature has no hook parameter).
• v1 data entry needs a free hook on a cycle node; a closed UI cycle has none (data socket only addresses its own node's hooks, v1 socket/ng_socket.c:391-397).
• A v1 cycle containing a UI node therefore requires a third node type with an injection port (bpf's ifMatch redirect — DF-3546; tee's left/right+connect — DF-3554); the UI is an interchangeable passenger, not the enabler. Not filed against this file.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.