DF-5848 — VERDICT

Status: REPRODUCED (deterministic kernel panic, seconds, kernel nfsd on loopback TCP; original capture on stock #0 from the DF-3072 run, fresh capture this run). Impact: remote/local DoS (panic) of INVARIANTS kernels via nfsd; no memory corruption, no escalation.

1. Reproduction

• Original (stock kernel #0: Thu Jul 2 06:02:54 UTC 2026, from the DF-3072 verification batch): pipelined kernel-NFS-client GETATTR/fstat load over a mount -t nfs -o tcp 127.0.0.1:/export loopback mount panicked after ~10 min — incidental_nfsd_panic.txt: panic: assertion "m->m_type == MT_DATA" failed in m_dup_data at /usr/src/sys/kern/uipc_mbuf.c:1806, stack m_dup_data ← nfs_realign.isra.3 ← nfsrv_rcv ← sys_nfssvc ← syscall2.
• This run (fresh, deterministic): df5848_pipe.c — a raw SunRPC/TCP client to 127.0.0.1:2049 (no mount, no valid RPC, no auth) streaming TCP_NODELAY LASTFRAG records of 142-149 bytes plus 16-record pipelined bursts. Panic in under 90 s (panic-run1.txt), stack identical. Booted kernel at capture time was the DF-5847 diagnostic build (#1 Oct 26) — its only delta vs stock is nd6.c (inert for the mbuf/nfs path; md5-verified equal for uipc_mbuf.c and nfs_socket.c: 179f41cf…/84b1b11d… are the FIXED copies, stock equals the tree at 0c8009550937a3fd4597a1b9225543ef/84b1b11d8894dff5f44b90337aa707ff — nfs_socket.c untouched, uipc_mbuf.c stock at capture).

2. Root cause (line-accurate; each step verified in source and the

final step empirically)

1. sys/netinet/tcp_output.c:896-922 — every segment is allocated MT_HEADER (m_gethdr/m_getl(..., MT_HEADER, M_PKTHDR, ...) at :898/:900/:942); if len <= MHLEN - hdrlen - max_linkhdr (:909) the payload is copied INTO that mbuf — one MT_HEADER mbuf holds hdr+data.
2. sys/net/if_loop.c:202+ (if_simloop) hands the SAME mbuf to netisr; tcp_input strips IP/TCP headers via m_adj — an MT_HEADER mbuf carrying pure data lands in the receiving socket buffer. soreceive explicitly accepts MT_DATA || MT_HEADER as stream data (sys/kern/uipc_socket.c:1473, :1779) and returns the original mbufs to the sio caller (:1842-1845).
3. sys/vfs/nfs/nfs_socket.c:2614 (nfsrv_rcv soreceive into sio) → nfsrv_getstream → on completed record nfs_realign(&ns_frag,...) at :2816. nfs_realign (:2256-2260) breaks on the first mbuf with m_len & 3 or misaligned m_data — guaranteed by sending records whose size % 4 != 0 (or by pipelined records split mid-mbuf by m_copym at :2769) — then m_dup_data(m, M_WAITOK) at :2267.
4. sys/kern/uipc_mbuf.c:1806: KKASSERT(m->m_type == MT_DATA) fails on the loopback MT_HEADER data mbuf → panic.

Why the original capture needed ~10 min of NFS-client luck while this trigger is deterministic: GETATTR requests are 4-byte-aligned XDR, so misalignment only arose from incidental record-mark straddling; sending deliberately misaligned record sizes hits the path immediately.

3. Fix and A/B validation

fix.diff relaxes the invariant to MT_DATA || MT_HEADER in m_dup_data — matching soreceive's own contract for stream data. The copy loop reads only the data region and always produces MT_DATA mbufs, so the output contract ("non-packet data chain for nfs_realign") is unchanged; MT_SONAME/MT_CONTROL mbufs remain rejected.

• Validation kernel: tri-fixed build (#1 Mon Oct 26, INVARIANTS, -Werror, RC=0): uipc_mbuf.c fix + DF-5846 + DF-5847 fixes (disjoint subsystems).
• A/B: identical df5848_pipe load (90 s+ budget, same nfsd setup) on the fixed kernel — no panic, nfsd up, connection serviced (run-fixed.log). Repeated for a longer 300 s run alongside the other two triggers' budgets.

4. Impact ceiling / privesc assessment

The assertion is a guard, not corruption: tripping it panics an INVARIANTS kernel (all this project's kernels) — DoS. Without INVARIANTS the copy itself would be harmless (it ignores m_type). There is no write primitive, no info leak, no lifetime issue — no path to uid=0. Reachability honestly stated: any local user can hit a loopback-serving nfsd (localhost mounts, common in testing/jails); a network-facing nfsd is hittable by any remote host that can reach 2049. Filed Low — consistent with a panic-only, service-load-gated trigger.