DF-4058
hw.etX.tx_intr_nsegs sysctl accepts 0 (no handler) -> integer division by zero panic on the TX hot path (sc_tx / sc_tx_intr_nsegs); the two rx sysctls validate v>0 but the tx one is a raw SYSCTL_ADD_INT
Summary
sc_tx_intr_nsegs is published via SYSCTL_ADD_INT with no validation, unlike its rx siblings which reject v<=0. et_encap computes sc_tx / sc_tx_intr_nsegs on every transmitted packet: sysctl =0 followed by any TX -> integer-divide panic. Root-only, one-sysctl hardening win. Validating-handler fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4058 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 244 B | ↓ raw | |
| verdict.json | file | 849 B | view raw |
README.md
file
↓ download raw
DF-4058
Hardware-gated finding - PoC skipped (no device on audit guest). Source citations in the pass-2 result block.
Fix: convert to a validating sysctl handler (reject v<=0) mirroring et_sysctl_rx_intr_npkts; defensively guard the divide
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
convert to a validating sysctl handler (reject v<=0) mirroring et_sysctl_rx_intr_npkts; defensively guard the divide
source-only
per-fix-DF-4058
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; hardware-gated (no device on audit guest); no guest run per allocation
No comments yet.