DF-5755 — kernel libiconv UCS converter accepts overlong (non-shortest) UTF-8 → arbitrary character synthesis into converted filenames

File audited (pass 2): sys/libiconv/iconv_ucs.c Reserved ID: DF-5755 Guest: DragonFly 6.5-DEVELOPMENT x86_64 (see logs/env.txt)

Root cause (one line)

utf8_to_ucs4() (sys/libiconv/iconv_ucs.c:411-478) decodes the leading byte into a width w (2/3/4) and concatenates the continuation payloads without ever checking that the decoded value is not representable in fewer bytes — so "\xC0\xAF" (2-byte overlong) decodes to U+002F /, and 4-byte encodings of BMP values reach encode_surrogate() (iconv_ucs.c:524-528, called from :218) with code < 0x10000, whose code - 0x10000 uint32-wraps into a phantom surrogate pair ("\xF0\x8F\xBF\xBF" → DB FF DF FF).

Threat / reachability

Any kernel consumer that feeds attacker bytes through a UTF-8→X kiconv converter gets characters the input bytes never spelled. The in-tree end-to-end path is msdosfs mounted with MSDOSFSMNT_KICONV and cs_local=UTF-8 (the UTF-16BE↔UTF-8 pairs are auto-registered by iconv_ucs_init(), iconv_ucs.c:377-383):

• create: unix2winchr() → convchr(pm_u2w) (msdosfs_conv.c:990) → iconv_ucs_conv() FROM_UTF8 branch (iconv_ucs.c:193-230) → the decoded character is written into the on-disk LFN by unix2winfn() (msdosfs_conv.c:559-579, no validation) and into the 8.3 alias by unix2dosfn() (msdosfs_conv.c:431-458, only magic 1/2 are special-cased).
• read back: the only / filter is win2unixfn()'s literal-unit check (msdosfs_conv.c:669-713) — it rejects an LFN containing /, and msdosfs then falls back to the 8.3 alias, which also carries the synthesized / and is returned verbatim by readdir.

Proven on the guest with uid 65534 (nobody) doing the creates on a root-mounted volume (root mounts; unprivileged users with write access corrupt the metadata — the same threat model as DF-5746).

What the evidence shows (baseline kernel)

1. witness.log (kernel module, cesu_witness.c): * "\xC0\xAF" → ret=0 out=00 2f (synthesized /, byte-identical to the valid "\x2F" case) * "\xF0\x8F\xBF\xBF" → ret=0 out=db ff df ff (surrogate wraparound)
2. run.log (msdosfs e2e): nobody creates "OV\xC0\xAFSLASH", "OV\xC0\xAEDOT", "OV\xE0\x80\xAFS3" — readdir returns "OV/SLASH" (hex 4f 56 2f 53 4c 41 53 48) and "OV/S3" — filenames containing a literal path separator, plus the alias "OV.DOT" (a name that never existed as a component).
3. Raw image dump (run.log tail): synthesized U+002F present in the on-disk LFN units (4f 00 56 00 2f 00 …, seq=0x41, attr=0x0f) and in the raw 8.3 alias (4f 56 2f 53 4c 41 53 48 20 20 20).
4. logs/difftest.log: base-system userland iconv(3) returns EILSEQ for all three overlong inputs — the kernel is the outlier.

Impact: FAT metadata corruption (/ in LFN and 8.3 names is invalid on every FAT consumer), filename spoofing/hiding across mounts and OSes (chkdsk/Windows interop, backup tools consuming readdir paths that contain /), and name aliasing ("OV\xC0\xAEDOT" becomes the distinct name "OV.DOT"). No memory corruption; severity Medium (CWE-176).

Files

Build

sh build.sh          # userland tools + cesu_witness.ko (on the guest)

Run

kldload /boot/kernel/msdos_iconv.ko           # pulls libiconv.ko
sh run5755.sh                                  # e2e baseline (also kldloads witness)
./difftest                                     # userland contrast

Expected output (baseline)

• witness: overlong-slash … out=00 2f, overlong-4b … out=db ff df ff
• dirent name="OV/SLASH" (hex 4f 56 2f …), name="OV.DOT"
• dump: all /-bearing LFN/8.3 patterns [FOUND]

On the patched kernel (fix.diff)

• witness: overlong-slash ret=-1, overlong-4b ret=-1 (rejected; output untouched)
• creates of the three overlong names → EINVAL; control name plainok still creates
• image dump: all seven //. patterns absent
• difftest output unchanged (userland never accepted them anyway)

DF-5755 — VERDICT

Status: reproduced (certain). Fix authored and validated on the guest (fix_status: fixed).

What was run

Guest DragonFly dfbsd 6.5-DEVELOPMENT #0 … x86_64 (logs/env.txt), stock kernel + msdos_iconv.ko + libiconv.ko. All triggers run as root for the mount, then drop to uid/gid 65534 (nobody) before creating files — kiconv5755.c (setgroups/setgid/setuid before the open(O_CREAT) loop). The kernel-side primitive was additionally proven in-module by cesu_witness.ko, which iconv_open()s the exact pair msdosfs opens (UTF-16BE←UTF-8, auto-registered by iconv_ucs_init, sys/libiconv/iconv_ucs.c:377-383) and iconv_convchr()s the adversarial sequences with an 8-byte out buffer.

Reproduced manifestations (baseline)

Why it matters (impact ceiling)

Not memory corruption. It is filesystem metadata corruption + filename spoofing reachable by an unprivileged local user with write access to any KICONV msdosfs mount (root mounts — identical setup bar to DF-5746):

• / inside on-disk names is invalid on every other FAT consumer (Windows/chkdsk, non-KICONV mounts fall back to the 8.3 alias — also corrupted here);
• readdir hands userland a filename containing / — tar/backup/script consumers interpret it as a path;
• overlong encodings alias with canonical ones ("OV\xC0\xAEDOT" reads back as "OV.DOT"), enabling name-hiding/spoofing games.

Fix validation (fix.diff: shortest-form rejection in utf8_to_ucs4)

Applied to the guest's /usr/src/sys/libiconv/iconv_ucs.c (stacked with DF-5756's fix), libiconv.ko rebuilt (-Werror clean, logs/module_build_patched.log), loaded before msdos_iconv.ko. Rerun of the exact baseline sequence:

fix_status: fixed, fix_baseline_reproduced: 1, fix_patched_reproduced: 0 (bad behavior gone), with no regression on valid conversions.

Notes

• Upstream FreeBSD sys/libkern/iconv_ucs.c (compared 2026-10-11) is identical in the affected function — the defect is upstream-shared.
• DF-2235 (read-before-bounds-check at iconv_ucs.c:247-254) is a different defect and is not re-reported here.
• PoC fixes vs. the seed (there was no seed; authored fresh): msdosfs args.mask/args.dirmask are literal mode bits, msdosfs chmod cannot add bits, dirent has no d_reclen on DF (use _DIRENT_DIRSIZ).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.