DF-4882 — onoe ath_rate_ctl_start() reachable KASSERT panic via rate-less IBSS beacon

What

sys/dev/netif/ath/ath_rate/onoe/onoe.c:285:

KASSERT(ni->ni_rates.rs_nrates > 0, ("no rates"));

DragonFly's default kernel config ships options INVARIANTS (sys/config/X86_64_GENERIC:56, verified in the running guest), so KASSERT is an active panic in production. A single unauthenticated 802.11 beacon/probe-response with a zero-length Supported Rates IE (and IBSS capability bit), received by an ath(4) interface running in adhoc (IBSS) mode with the onoe ratectl module attached, reaches this KASSERT and panics the kernel.

Full static chain (every hop verified in-tree)

1. adhoc_recv_mgmt processes BEACON/PROBE_RESP frames — unauthenticated (sys/netproto/802_11/wlan/ieee80211_adhoc.c:678-699).
2. ieee80211_parse_beacon only flags a missing RATES element (IEEE80211_BPARSE_RATES_INVALID, ieee80211_input.c:667-668) — a zero-length RATES IE passes IEEE80211_VERIFY_ELEMENT (checks ie[1] > maxlen only — ieee80211_input.h:31-41; 0 <= 15) with clean status.
3. IBSS capinfo + unknown addr2 → ieee80211_add_neighbor (ieee80211_adhoc.c:727-735).
4. ieee80211_init_neighbor → ieee80211_setup_rates(ni, sp->rates, ...) with rates[1] == 0 → rs_nrates = 0 → ieee80211_fix_rate loop body never executes → okrate == 0 → returns error (sys/netproto/802_11/wlan/ieee80211_proto.c:682,746-748) — and the return value is ignored (ieee80211_node.c:1559-1561).
5. ieee80211_add_neighbor proceeds unconditionally to ic->ic_newassoc(ni, 1) (ieee80211_node.c:1607-1608).
6. ath_newassoc → ath_rate_newassoc(sc, an, isnew) (sys/dev/netif/ath/ath/if_ath.c:1271, ~ath_newassoc body).
7. onoe.c:189-190 isnew → ath_rate_ctl_start → KASSERT panic (onoe.c:285). The very next lines (onoe.c:316-321) explicitly document that nodes without a rate set are expected here ("orphaned nodes created in adhoc mode may not have any rate set ... This is not fatal") — but on INVARIANTS kernels the KASSERT fires first and it is fatal.

The amrr sibling has the identical KASSERT (amrr.c:312, filed separately as context only; this pack covers onoe).

Threat model

Unauthenticated radio-range peer (IBSS participant or spoofer of the cell's BSSID) → kernel panic = remote DoS. Preconditions: Atheros NIC + onoe ratectl module attached (sample is the shipped default, X86_64_GENERIC:266) + IBSS/adhoc vap + INVARIANTS kernel (the default).

Why not reproduced on the QEMU guest

The guest has no Atheros NIC (pciconf shows only a virtio vgapci) and no onoe.ko module (env.txt). The chain is proven statically end-to-end above.

Fix

Replace the KASSERT with the graceful fallback the surrounding code already implements (drop the rate-ctl start for empty rate sets), matching the code's own comment that this case "is not fatal". See fix.diff.

DF-4882 VERDICT

Status: inconclusive (guest lacks the required hardware; static chain proven end-to-end; no kernel manifestation possible on this guest).

What was verified

• Guest kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0 .../sys/X86_64_GENERIC — the shipped default config includes options INVARIANTS (verified at /usr/src/sys/config/X86_64_GENERIC:56 in the guest), so KASSERT is an active panic, not a debug nicety. This is the decisive environmental fact for severity: the assertion is production-reachable.
• Guest hardware: pciconf -l shows only vgapci0@pci0:0:2:0 chip=0x11111234 (virtio-gpu). No Atheros (168c:) device, no radio.
• Guest modules: /boot/kernel contains if_ath.ko, ath_hal.ko, ath_rate.ko (strings identify it as sample, the default), and wlan_amrr.ko. No onoe module is shipped.
• Source audit chain (README.md) — every hop cited path:line; nothing relies on speculation. The empty-rate-set scenario is acknowledged by the code itself (onoe.c:316-320 "orphaned nodes created in adhoc mode may not have any rate set ... This is not fatal"), and ieee80211_setup_rates's error return for zero rates (ieee80211_proto.c:746-748) is demonstrably ignored at ieee80211_node.c:1559-1561.

Why it cannot be exercised here

Triggering requires an ath(4) interface in IBSS mode with onoe attached and an injected 802.11 beacon — none of which QEMU/virtio can provide (no NIC, no 802.11 stack attachment, module absent). Building onoe.ko in the guest would not help: ic_newassoc is only wired to onoe code when an ath device attaches through it.

Impact ceiling

Remote kernel panic (DoS) of the default INVARIANTS kernel, from one crafted frame, for ath+onoe+IBSS configurations. amrr.c:312 has the same bug (out of this file's scope).

Fix validation

Not possible on this guest (no ath hardware). fix.diff authored against the read-only tree: converts the KASSERT into the graceful path the surrounding code already implements. fix_status: not_applicable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.