# Untrusted pointer and count from wire

Wire messages carrying raw pointers, SGL counts or lengths used unchecked in copies or dereferences

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $20,000; latest 2026-08-06. Updated 2026-11-02._

## How it works
A protocol message carries a field the receiver treats as a trusted local value: a kernel pointer, a scatter-gather list entry count, or a byte length. The receiver assumes the peer is a trusted back-channel and uses the field directly — dereferencing the pointer, or copying `count` bytes into a fixed buffer sized for the legitimate case. The broken assumption is that anything arriving on the wire is already validated; in reality the sender controls both the pointer and the count, so the receiver performs a write-what-where or an overflow on the sender's behalf [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md).

## Where it shows up
- HA/peer-sync or storage-target protocols embedding raw kernel pointers as message fields [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md)
- Copy loops where a wire-supplied count feeds `memcpy` into a fixed-size heap buffer (e.g. 64-byte SGL buffer) [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md)
- IPC structs with a pointer field consumed by a receiver thread without provenance checks [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)
- Driver copies where a length field (`inf_len`) is not compared against the destination buffer size (`sector_size`) [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)
- Guest-to-hypervisor channels (VMCI/HGFS/VSOCK) that bypass firewalls and IDS [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit.md)
- Listen ports assumed firewalled but reachable (unauthenticated TCP 999) [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md)

## How to review
For every field crossing a trust boundary, ask: is this value validated against a bound derived from the *receiver's* buffer, not the sender's claim? The invariant: no wire-supplied pointer is dereferenced, and no wire-supplied count reaches a copy without a check that it fits the destination. Check that the peer channel is authenticated, that the port is actually firewalled, and that pointer fields are either absent from the wire format or translated through a handle table. Trace each `memcpy`/dereference back to its source field.

## How finders spotted it
- Source review of a vendor Java stack for `doPrivileged` deserialization and reflection sinks, plus reverse engineering of the compiler receiver thread protocol to spot the trusted `compiler_data` pointer [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)
- Auditing an open-source driver for missing bounds checks on `inf_len` vs `sector_size` [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)
- Incident response: dropped binaries' behavior (leak, corruption, kernel shellcode) matched known CVEs; PDB paths dated a year before disclosure, flagging a zero-day [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit.md)
- Prompted agents to audit remotely reachable kernel code; CTL HA stood out as unauthenticated, remote, and full of trusted pointers [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md)

## Variants seen
- Trusted pointer field in an IPC struct used for `memcpy` [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)
- Length field overflowing a fixed sector buffer [E1](https://bugbountylibrary.com/r/h1%3A1379975.md)
- Raw kernel pointers as HA message fields [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md)
- Wire-supplied SGL entry count overflowing a 64-byte heap buffer [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md)
- TOCTOU in VMCI producing an OOB write [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit.md)

## Impact and severity
Remote unauthenticated root on FreeBSD CTL HA, each bug independently sufficient [E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md). On consoles, chained Java and native flaws reached JIT code execution and kernel panic [E1](https://bugbountylibrary.com/r/h1%3A1379975.md). ESXi chain went guest-to-hypervisor kernel control, with VSOCK used to evade monitoring [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit.md). Impact rises with reachability (network, unauthenticated) and chaining of leak + corruption + escape [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **FreeBSD** (CAM Target Layer (CTL) HA) (version not stated): The Taking of FreeBSD One Two Three. Report: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1379975.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-the-taking-of-freebsd-one-two-three.md