An attacker on the same local L2 segment can craft an ARP request specifying larger-than-expected length fields. When in_arpreply() processes these packets, it uses the attacker-controlled values as lengths for memcpy(), causing the kernel to copy data from adjacent heap or stack memory into the ARP reply. This allows an attacker to leak sensitive kernel memory, including KASLR-defeating pointers and return addresses. The vulnerability has been present since the initial 2003 code import and remains unpatched in all tagged releases as of October 2026, despite a fix existing in the master branch.

Attack Chain

1. Attacker identifies a target host on the same L2 network segment.
2. Attacker crafts a custom ARP REQUEST packet using a tool like Scapy.
3. Attacker modifies the ARP header fields ar_hln (hardware address length) or ar_pln (protocol address length) to values exceeding the legitimate 6 (MAC) and 4 (IPv4) bytes respectively.
4. Attacker transmits the malformed ARP REQUEST to the victim host.
5. The victim's kernel (arpintr()) fails to validate the address length fields and proceeds to in_arpreply().
6. The in_arpreply() function performs an out-of-bounds memcpy() of kernel memory based on the attacker's requested lengths.
7. The leaked kernel memory is encapsulated into an ARP REPLY packet and transmitted back to the attacker.
8. Attacker receives the packet and parses the OOB data to extract kernel pointers, facilitating the bypass of KASLR.

Impact

Successful exploitation results in the disclosure of sensitive kernel memory. An attacker can recover kernel .text return addresses and KVA pointers, effectively defeating Kernel Address Space Layout Randomization (KASLR). This information leakage serves as a critical prerequisite for chaining further exploits to achieve arbitrary code execution or privilege escalation. Every release of DragonFly BSD is affected, and the attack is undetectable to the host system.

Recommendation

1. Monitor local network segments for ARP packets with non-standard ar_hln or ar_pln values using network-based intrusion detection systems.
2. Apply the upstream patch from commit 4bb22ffcf2e9fb44995fbfd9945194afc87fb182 to all custom builds, as no official tagged release currently includes the fix.
3. Implement strict ARP packet filtering or validation at the L2 switch level where possible to reject packets with invalid hardware or protocol address lengths.