DF-5698 — kernel inet_ntop never sets errno (documented contract unimplemented)

Severity: Info — correctness/contract divergence, no in-tree security impact. File: sys/libkern/inet_ntop.c (pass-2 GLM 5.3 re-audit)

What was verified (the whole file, not just this finding)

A userland differential rig compiles the audited kernel TU itself (sha256-verified identical host↔guest: 6ddc914991203a5f4e54544a8d8c511790e0428e3400cf376d2ad49d87) as a renamed symbol (-Dinet_ntop=dk_inet_ntop -Dksnprintf=snprintf -Dksprintf=sprintf) and compares it against DragonFly libc's inet_ntop (the errno-setting twin at lib/libc/inet/inet_ntop.c) over ~172.5M total comparisons:

• IPv4 string equivalence (corner cross-product 194k, sequential 4M, random 40M)
• IPv6 string equivalence (structured zero-run space 567 combos, RFC4291 specials, random 40M, zero-biased bytes)
• Size-gate decision equivalence at every size: v4 sizes 0..16, v6 sizes 0..46 — kernel accept/reject boundary identical to libc at every step; accepted strings identical, strlen+1 <= size always
• Guard-page overflow canary: dst placed so dst[size] is the first byte of a PROT_NONE page (and for size==0, dst is the PROT_NONE page start — zero writable bytes). 900k knife-edge calls, 400k accepted writes, zero faults — proof there is no off-by-one anywhere in the size gate
• af-dispatch decision equality for 16 af values (DragonFly: AF_INET=2, AF_INET6=28)
• inet_pton round-trip on all IPv4 outputs

Result: MISMATCH=0 on every run. The formatter is memory-safe and byte-equivalent to its libc twin. The only divergence: the kernel copy never sets errno (P6 in run.log: errno-after=0 for both too-small-dst and bad-af), although its own doc-comment promises "NULL (see errno)" (inet_ntop.c:38-39) and the libc twin sets EAFNOSUPPORT (lib/libc/inet/inet_ntop.c:62) and ENOSPC (:88,:169,:187). No in-tree kernel consumer reads errno after inet_ntop (all 12 call sites are kprintf arguments in sys/netinet/ip_icmp.c with correctly sized INET_ADDRSTRLEN buffers, and kprintf renders NULL %s as "(null)" — sys/kern/subr_prf.c:750-753), hence Info, not higher.

How to reproduce

On the host (from the repo root), with the QEMU guest up:

./dfbsd-qemu/vm.sh up          # if down
sh findings/poc/DF-5698/build.sh   # transports rig to guest, builds (guest gcc 8.3)
sh findings/poc/DF-5698/run.sh     # full differential + errno fix validation

Expected decisive output (run.3.log):

P6: size-too-small kernel-returns=0x0 errno-after=0 (ENOSPC=28 EAFNOSUPPORT=47)
P7: guardpage calls=500000 accepted=200000 (no SIGSEGV)
TOTAL=25889126 MISMATCH=0 ROUNDTRIP_BAD=0
variant=BASELINE too_small: ret=0x0 errno=0(NOT-SET) | bad_af: ret=0x0 errno=0(NOT-SET)
variant=FIXED    too_small: ret=0x0 errno=28(ENOSPC) | bad_af: ret=0x0 errno=47(EAFNOSUPPORT)

The errno=0(NOT-SET) lines on BASELINE are the finding; the FIXED lines show fix.diff implements the documented contract without changing any formatting behavior (fixed TU also passes the full differential: MISMATCH=0).

Files

harness.c            the differential driver (P1..P7 phases)
fixcheck.c           errno-contract probe (baseline vs FIXED variant)
inet_ntop_fixed.c    audited TU + errno fix (built on host from sys/ copy)
shim/sys/systm.h     userland shim for the kernel TU
shim/netinet/in.h    empty shim (avoids libc decl clash after -D rename)
build.sh run.sh      host-side orchestration (guest via ssh aliases)
build.log run.log run.2.log run.3.log env.txt fix_run.log fix_build.log
fix.diff             git-apply-able fix (validated: git apply --check clean)
manifest.json        machine catalog
verdict.json         machine verdict (persist_poc.py / persist_fix.py input)

DF-5698 VERDICT — kernel inet_ntop: errno contract unimplemented (Info)

Bottom line

Reproduced (informational divergence, impact=none). The kernel copy of inet_ntop at sys/libkern/inet_ntop.c never sets errno, breaking the contract its own doc-comment states ("return: pointer to presentation format address (dst'), or NULL (see errno)" — sys/libkern/inet_ntop.c:38-39) and diverging from its byte-identical-algorithm libc twin (lib/libc/inet/inet_ntop.c), which setsEAFNOSUPPORT(lib/libc/inet/inet_ntop.c:62) andENOSPC(lib/libc/inet/inet_ntop.c:88, :169, :187). Proven deterministically by the rig's P6/fixcheck probes: baseline leaveserrno=0` after both failure modes.

No memory-safety defect exists in this file. Exhaustive differential testing (≈172.5M comparisons, 3 independent seeds) found zero divergence from the libc twin in output strings, in the accept/reject decision at every buffer size (0..16 v4, 0..46 v6), and zero guard-page faults across 900k knife-edge calls with destination buffers bounded by PROT_NONE pages (including zero-writable-byte size==0 destinations).

Why this is Info and not higher

• All 12 in-tree kernel call sites are kprintf arguments in sys/netinet/ip_icmp.c (ip_icmp.c:295, :474, :476, :608-609, :859-864, :880-883, :1134-1135), each passing a stack buffer of INET_ADDRSTRLEN (=16), which is exactly the worst-case need of inet_ntop4 ("255.255.255.255" = 15 chars + NUL; the gate l >= size at sys/libkern/inet_ntop.c:76 accepts exactly at size ≥ strlen+1).
• None of them reads errno after the call; NULL returns are impossible for their (af, size) pairs anyway, and kprintf renders a NULL %s as "(null)" (sys/kern/subr_prf.c:750-753).
• No AF_INET6 kernel caller exists in-tree, so inet_ntop6 is currently exercised only via this rig and by out-of-tree KLDs.
• The missing errno matters only to KLD authors who follow the POSIX/libc contract published in the file's own header comment — a correctness trap, not an exploitable condition.

Root cause

The file was synced from FreeBSD r213103-era libkern (header: sys/libkern/inet_ntop.c:18) without the errno assignments the libc twin carries. The four failure returns that should set errno:

• sys/libkern/inet_ntop.c:51-52 — default af case (should be EAFNOSUPPORT)
• sys/libkern/inet_ntop.c:76-78 — inet_ntop4 size gate (should be ENOSPC)
• sys/libkern/inet_ntop.c:158-159 — inner v4-embed size gate (ENOSPC)
• sys/libkern/inet_ntop.c:174-176 — inet_ntop6 final size gate (ENOSPC)

Boundary-math proof (why no overflow exists)

• inet_ntop4 formats into a 16-byte staging buffer (never truncated), then requires l < size (i.e. size >= strlen+1) before strlcpy(dst, tmp, size) — bounded exactly (sys/libkern/inet_ntop.c:75-80).
• inet_ntop6 builds in a 46-byte staging buffer whose maximum possible content is 39 chars + NUL (8×4 hex + 7 colons); the final gate compares tp - tmp (NUL included, since *tp++ = '\0' at :169 precedes it) against size before strcpy (sys/libkern/inet_ntop.c:174-177) — accepts exactly when strlen+1 <= size. The trailing-: write at :168 and the embedded-v4 call at :158 were hand-verified to stay within the staging buffer.
• Empirical: 900k guard-page knife-edge calls (dst[size] on a PROT_NONE page; size==0 with zero writable bytes) — zero SIGSEGV, all accepted lengths equal canonical lengths (P7 in run.log/run.2.log/run.3.log).

Fix validation

fix.diff adds the four errno assignments plus <sys/errno.h> (git apply --check clean against sys/). Validated in the same rig: fixcheck on the baseline TU prints errno=0(NOT-SET) for both failure modes (exit 1); on the fixed TU errno=28(ENOSPC) / errno=47(EAFNOSUPPORT) (exit 0). The fixed TU re-ran the full 23.9M-comparison differential with MISMATCH=0 — the fix changes nothing except the documented errno contract.

Environment

DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (X86_64_GENERIC), guest gcc 8.3 [DragonFly]. Kernel TU sha256 6ddc914991203a5f4e54544a8d8c511790e0428e3400cf376d2ad49d87 identical between the audited tree and the guest /usr/src copy used for the build. Guest left clean (only /tmp/ntop used; no kernel changes; no panic).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.