DF-5256
DragonFly-only unlocked traversal of ifp->if_multiaddrs in urtwn_set_multi (upstream takes if_maddr_rlock)
Summary
The #ifdef __DragonFly__ branches walk the multicast TAILQ with no maddr lock while concurrent if_addmulti/if_delmulti (unpriv socket group joins, IGMP timers) mutate it - freed ifma use or torn link pointers -> panic in init/SIOCADDMULTI. DF branch dropped the upstream if_maddr_rlock; tokenization may partially mask (hence speculative). Port-the-lock fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5256 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 994 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
per-fix-DF-5256
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (hardware-gated; static trace, deterministic leak logic / narrow race window)
No comments yet.