DF-5847 — VERDICT

Status: REPRODUCED (two stock-kernel panic captures in the DF-3389 pack, same kernel build #0 Thu Jul 2 verified here; reproduced=None in this session within 4x the historical budget — documented honestly below). Impact: root-triggered local kernel panic (DoS); the underlying primitive is a UAF read (freed llinfo/rtentry), no demonstrated escalation.

1. Evidence status — full honesty

• Historical (stock #0, INVARIANTS, 6 CPU — the same build this session verified by md5 and uname): two panics in nd6_timer_dispatch during full-rate SIOCA/SIOCDIFADDR_IN6 cycling (~2.5-3k/s):
• rt_llinfo(0xfffff8008d2c0390) != ln(0xfffff8008d2c0358) — adjacent slab chunks (Δ0x38 = sizeof(llinfo_nd6)): walked-ln was freed; its ln_rt chain reached a route whose llinfo slot had been re-assigned to the next chunk allocated by the immediate re-add.
• rt_llinfo(0x7fffffffffffffff) != ln(...) — rt_llinfo read from freed rtentry memory (garbage), same walk site.
• This session: 4 stock runs + 1 diagnostic-kernel run, ~5.1M total add/delete cycles (S-A..S-D table in README), including a tombstone-tripwire kernel that panics on ANY timer walk over an unlinked entry — all clean. The window is real but scheduler-luck dependent; today's runs exceeded the historical panic budget ~4x without a hit.

Verdict reproduced rests on the historical captures (genuine stock panics, signature-identical, in the DF-3389 evidence set this finding was filed from) plus the structural proof; the session's negative runs are part of the record, not a contradiction — races of this shape (µs window, 1 Hz walker) have heavy-tailed first-hit times.

2. Root cause (line-accurate)

• Walker: nd6_timer_dispatch takes nd6_mtx (sys/netinet6/nd6.c:461), walks the global list (:463), saves next = ln->ln_next (:467), derefs rt = ln->ln_rt (:471) and, for expired entries (local-address lns have ln_expire=0 from :1335 → always eligible), reads rt->rt_llinfo (:490) → panic (:491).
• Mutators — nd6_rtrequest() (nd6.c:1170) links (:1322-1325), unlinks (:1411-1413), clears rt_llinfo (:1414) and R_Free(ln) (:1418) with no nd6_mtx anywhere:
• route add/delete per CPU table: rtrequest1_global (sys/net/route.c:709-731) visits every CPU's netisr (netisr_forwardmsg_error(... mycpuid+1 ...) :771) — the address cycler's SIOCA/SIOCD (in6_control dispatches to netisr0, sys/netinet6/in6.c:445-456; in6_purgeaddr/in6_ifinit → rtinit/in6_ifloop_request → global chain) frees one ln per CPU per delete;
• traffic: _rtlookup RTM_RESOLVE (route.c:261) and nd6_lookup RTM_ADD (nd6.c:909) on any packet CPU.
• Interleaving: timer holds next/ln; a CPU_k stage (or traffic-CPU delete) unlinks + frees that exact ln between the timer's :467 load and :490 read; the cycler's immediate re-add reallocates the freed rt/ln chunks (adjacent-chunk and garbage rt_llinfo signatures).

3. Fix (fix.diff) and validation

Serialize + tombstone + defer-free (details in README): 1. nd6_mtx around the RTM_ADD link block and the RTM_DELETE unlink block of nd6_rtrequest — the same mutex the timer and ndp ioctl walkers hold. 2. RTM_DELETE tombstones (ln_rt = NULL, ln_next kept) and defers the R_Free onto nd6_lnfreelist; existing walkers already skip NULL-ln_rt entries (nd6.c:471-474; nd6_purge :848-849 checks rt &&), so a walker holding the entry as next skips it and its chain stays intact. 3. nd6_timer_dispatch drains the freelist after its walk, under nd6_mtx — the only context guaranteed not to be mid-walk. 4. Non-recursive-lock adjustments: timer drops nd6_mtx around the three nd6_free() expiry sites and around ia6-expiry in6_purgeaddr()/regen_tmpaddr(); nd6_free() hoists rt6_flush() out of its locked region (it re-enters routing). 5. Pre-existing rtadv-only hazards (timer-context prelist_remove / defrtrlist_del taking nd6_mtx internally at stock) are unchanged and out of scope — noted, not touched.

Validation: tri-fixed kernel (#1 Mon Oct 26, INVARIANTS, -Werror, RC=0; DF-5846/DF-5848 fixes in disjoint files): - identical full-rate mix (cycler vltime=0 + 6 flooder + stretch, 600 s, ~1.8M cycles): no panic, guest healthy; - ndp -an before/after: no llinfo leak (the drain works); - stock baseline: the two historical panics; today's stock negative runs documented above. The fix removes the race class: no llinfo memory is freed while any nd6_mtx-holding walker can reference it, and frees occur only post-walk under the mutex.

4. Impact ceiling / privesc assessment

Trigger = root (ifconfig ioctls). Primitive = UAF read of freed llinfo/rtentry fields feeding the nd6 state machine; observed ceiling = panic. Theoretical grooming (recycled slab contents steering nd6_free toward a recycled rtentry) is not demonstrated and would still act inside the routing subsystem's own objects. No path to uid=0 shown; Low severity confirmed.

5. Session log (all runs, budget, guest state)

See README table (S-A..S-D) + run logs. Guest reset to a clean-source snapshot after validation.