[Bug 292023] ipfw_nat64: kernel panic when combining nat64lsn + nat64clat over a bridge

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292023

--- Comment #8 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=2e6b22abf44d99b84abf17fe25ca2e8f89716c04

commit 2e6b22abf44d99b84abf17fe25ca2e8f89716c04
Author:     Teddy Engel <engel.teddy@gmail.com>
AuthorDate: 2026-06-02 16:24:57 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-06-22 22:15:36 +0000

    ipfw/nat64: Fix type confusion panic when using wrong NAT64 instance type

    Add etlv type validation to ipfw_nat64clat() and ipfw_nat64stl() to
    verify that the retrieved instance is actually a nat64clat instance
    before use.

    All NAT64 instance types share the same srvstate[] array but have
    different struct layouts.
    Without type validation, using the wrong instance type with
    a handler causes type confusion and kernel panic.

    Signed-off-by:  Teddy Engel <engel.teddy@gmail.com>
    PR:             292023
    Reviewed by:    pouria
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2259

 sys/netpfil/ipfw/nat64/nat64clat.c | 3 ++-
 sys/netpfil/ipfw/nat64/nat64stl.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.