undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407)

whitepaper/outreach/dragonflybsd.md

@@ -0,0 +1,40 @@
+# DragonFly BSD — CWE-407 Disclosure Brief
+**2026-04-05 · 5 confirmed defects · All patched**
+
+## Finding
+
+Five O(N²) / O(N×k) algorithmic complexity defects across DragonFly BSD's network interface address lookup, multicast list management, and devfs device lookup infrastructure. All are linear scan patterns in hot paths where hash tables or direct pointer access should be used.
+
+## The Defects
+
+**dragonflybsd-0001 (HIGH):** `sys/net/if.c` — `ifa_ifwithaddr`, `ifa_ifwithnet`, `ifa_ifwithdstaddr`
+
+Two-level nested loop — outer `for` loop over `ifnet_array` (I interfaces), inner `TAILQ_FOREACH` over `if_addrheads[mycpuid]` (A addresses per interface). O(I×A) per call. Called from `ip_dooptions()` inside `ip_input()` — per-packet on source-routed traffic. At I=50, A=20: 1,000 comparisons per packet. Fix: per-CPU hash table keyed on `(AF, address bytes)` → `ifaddr*`. O(1) lookup.
+
+**dragonflybsd-0002 (MEDIUM):** `sys/net/if.c` — `if_delallmulti_serialized`
+
+Marker-walk (outer, N multicast entries) calls `if_delmulti_serialized()` for each, which re-scans the same list to find the entry by address comparison. O(N²) — the pointer is already in hand from the outer walk. Fix: add `if_delmulti_ifma()` accepting direct `ifmultiaddr*` pointer; skip the scan.
+
+**dragonflybsd-0003 (MEDIUM):** `sys/net/if.c` — `if_addmulti_serialized`
+
+Two sequential `TAILQ_FOREACH` scans over `if_multiaddrs` per call — duplicate check then link-layer mapping. O(N) per call × N calls in batch multicast join = O(N²) total. Fix: hash set on `sockaddr` for O(1) duplicate check.
+
+**dragonflybsd-0004 (MEDIUM):** `sys/vfs/devfs/devfs_core.c` — `devfs_destroy_related_worker`
+
+`TAILQ_FOREACH` over global `devfs_dev_list` with `goto restart` on each child found. O(N×C) where N=total devices, C=children of needle. Triggered on device detach (USB removal etc.). Fix: collect-then-destroy — single O(N) pass to collect children, then destroy without restart.
+
+**dragonflybsd-0005 (HIGH):** `sys/vfs/devfs/devfs_core.c` — `devfs_find_device_by_name_worker`
+
+Two sequential `TAILQ_FOREACH` scans — `devfs_dev_list` by name, then `devfs_alias_list` by alias. O(N) per `/dev/` open or stat. Every device open goes through this path. Fix: hash tables keyed on device name string for both lists. O(1) average per open.
+
+## Contact
+
+DragonFly BSD mailing list: `kernel@dragonflybsd.org`
+Project: https://www.dragonflybsd.org/
+Bug tracker: https://bugs.dragonflybsd.org/
+
+## Status
+
+All 5 defects patched as of 2026-04-05. Patches: `dragonflybsd-0001-ifa-ifwithaddr-hash.patch`, `dragonflybsd-0002-if-delallmulti-direct-ptr.patch`, `dragonflybsd-0003-if-addmulti-hash-dedup.patch`, `dragonflybsd-0004-devfs-destroy-collect-then-destroy.patch`, `dragonflybsd-0005-devfs-find-device-hash.patch`.
+
+dragonflybsd-0001 and the parallel defect in NetBSD (netbsd-0001) share the same root cause — the `ifa_ifwithaddr` family of functions uses nested interface+address walks in both kernels.

whitepaper/outreach/netbsd.md

@@ -0,0 +1,36 @@
+# NetBSD — CWE-407 Disclosure Brief
+**2026-04-05 · 4 confirmed defects · All patched**
+
+## Finding
+
+Four O(N²) / O(N×k) algorithmic complexity defects across NetBSD's network interface address lookup, kernel credential group membership, multicast sysctl traversal, and PCI resource enumeration. All are linear scan patterns in hot paths where hash tables, binary search, or single-pass traversal should be used.
+
+## The Defects
+
+**netbsd-0001 (HIGH):** `sys/net/if.c` — `ifa_ifwithaddr`, `ifa_ifwithnet`, `ifa_ifwithdstaddr`
+
+`IFNET_READER_FOREACH` (I interfaces) × `IFADDR_READER_FOREACH` (A addresses). O(I×A) per call. Called from `ip_dooptions()` inside `ip_input()` — per-packet on source-routed traffic. At I=50, A=20: 1,000 comparisons per packet. Fix: per-AF hash table `ifaddr_hashtab[]` keyed on address bytes → `ifaddr*`. O(1) lookup.
+
+**netbsd-0002 (MEDIUM):** `sys/kern/kern_auth.c` — `kauth_cred_uucmp`, `kauth_cred_ismember_gid`
+
+`kauth_cred_uucmp` loops over `uuc->cr_ngroups` (N) calling `kauth_cred_ismember_gid` for each, which linearly scans `cred->cr_groups` (M). O(N×M) total. Called from vnode permission checks and NFS credential matching. Fix: sort `cr_groups` on credential creation; use `bsearch` in `kauth_cred_ismember_gid`. O(N log M) total.
+
+**netbsd-0003 (LOW):** `sys/netinet/in.c` — `in_multicast_sysctl`
+
+Triple nested loop (interfaces × addresses × multicast groups) traversed twice — once for buffer size estimation, once to copy. Double-pass multiplies O(I×A×G) work by 2. Fix: single-pass with dynamic buffer growth; eliminate re-traversal.
+
+**netbsd-0004 (LOW):** `sys/dev/pci/pciconf.c` — `pci_resource_is_reserved`, `setup_iowins`, `setup_memwins`
+
+`pci_resource_is_reserved()` does `LIST_FOREACH` over `pciconf_resource_reservations` (O(R)) called per window. Plus insertion-sort in `get_io_desc`/`get_mem_desc`. O(N×R) + O(N²) for sort during PCI enumeration. Fix: sorted array + `bsearch` for O(log R) reservation lookup; `qsort` once at end instead of insertion sort.
+
+## Contact
+
+NetBSD security: `security-alert@NetBSD.org`
+NetBSD tech mailing list: `tech-net@NetBSD.org`
+Project: https://www.netbsd.org/
+
+## Status
+
+All 4 defects patched as of 2026-04-05. Patches: `netbsd-0001-ifa-ifwithaddr-hash.patch`, `netbsd-0002-kauth-cred-ismember-bsearch.patch`, `netbsd-0003-in-multicast-sysctl-single-pass.patch`, `netbsd-0004-pci-resource-bsearch.patch`.
+
+netbsd-0001 and dragonflybsd-0001 share the same root cause — the `ifa_ifwithaddr` family of functions uses nested interface+address walks in both kernels.