DF-4746

am79900_start_locked feeds unbounded mbuf chains into lance_put, which memcpy's them into a fixed LEBLEN(1522)-byte TX buffer slot with no length clamp

Summary

lance_put walks the whole chain copying m->m_len at advancing offsets into the per-slot TX buffer; nothing bounds the total to LEBLEN(1522) - a longer chain overruns the slot and, from the last slot, the 32K bus_dmamem region. Unpriv reachability closed (ether_ioctl caps MTU at ETHERMTU; VLAN ~1518; remaining vector is root-only BPF write). Hardening: one-line pkthdr.len guard at dequeue. Twin in am7990.c. [VERIFIED pass2: lance_put walks unbounded chains into the 1522-byte TX slot; no LANCE NIC in QEMU; pkthdr drop guard compiled at both sites]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Kernel memory corruption (UAF / OOB write)
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE: CWE-120
File: sys/dev/netif/lnc/am79900.c
Lines: 560
Area: dev
Discovered: 2026-09-23
Updated: 2026-09-23

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:05
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:05
Runtime: —
Kernel: per-fix-DF-4746
fix.diff: findings/poc/DF-4746/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4746 · 4 files

File	Type	Size
README.md	—	236 B	↓ raw
fix.diff	—	976 B	view raw
manifest.json	—	394 B	view raw
verdict.json	—	1.7 KB	view raw

README.md

↓ download raw

DF-4746 evidence pack

What

am79900_start_locked feeds unbounded mbuf chains into lance_put

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-4746

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - no lnc hardware in QEMU

Verified recommended fix

drop chains with pkthdr.len > LEBLEN - ETHER_CRC_LEN before lance_put (am79900 + am7990)

Verdict

Line-accurate confirmation; runtime demonstration not possible on this guest (no LANCE/PCnet NIC in QEMU; the lnc driver is compiled into X86_64_GENERIC as device lnc0 but never attaches). lance_put (lance.c:309-326) walks the whole chain copying m->m_len at advancing offsets into a fixed LEBLEN(1522)-byte TX slot with no total bound; am79900.c:560 / am7990.c:523 feed it directly from ifq_dequeue. Unprivileged reachability is closed today (ether_ioctl caps MTU at ETHERMTU; remaining vector is root-only BPF writes). Fix adds a pkthdr.len > LEBLEN - ETHER_CRC_LEN drop guard at both dequeue sites; both files compiled in the F40FIX build (lnc in kernel).