From: "Theo de Raadt" <deraadt@openbsd.org>
Subject: Re: sys/net/pf_ioctl.c: out of bounds read in pf_rule_copyin
To: Alexandr Nedvedicky <sashan@fastmail.net>
Cc: Johann H??pfner <hoepf@cit.tum.de>, tech@openbsd.org
Date: Mon, 06 Jul 2026 08:26:30 -0600

Alexandr Nedvedicky <sashan@fastmail.net> wrote:

> what  is really missing here is check which ensures the DIOCADDRULE
> ioctl comes with the right size of data
> (size(from) == sizeof (struct pfioc_rule)).

Not sure I understand what you are saying here, but let me try.

ioctl's with structure-copy (in, or out, or in+out) encode the size inside
the #define of the memory required, which is then allocated inside the kernel
to allow a complete copy back and forth from userland. If userland's memory
does not exist in either direction, the ioctl falis with EFAULT.

Userland could pass in bogus data.  Validation required depends upon the
specific ioctl's risk profile.  But the data block is complete.

> my understanding is that there is enough address space mapped on stack,

It is not allocated on the stack.