Theo de Raadt renamed the field name in the pfsync packet header following the arrival of a false vulnerability report generated by AI tools. The field "pfcksum[PF_MD5_DIGEST_LENGTH]" was renamed to "spare[16]" because the AI model believed that the name pfcksum indicated that the field stored a hash or checksum of the packet content, and since the field was not checked, it concluded that there was a vulnerability in the code.
Theo explained that early in the development of pfsync, the specified field was added to store a hash of the rule set to optimize state checking. Ultimately, this idea was abandoned, but the field was retained for backward compatibility and always remained filled with zeros. In the code, this field was only mentioned in the packet structure but was not checked or filled.
The generated AI report claimed a vulnerability existed because the field is computed when sending a packet, but not checked upon receipt. The report detailed the operation and source of the problem, but in reality, it was an AI hallucination, fabricated solely based on the usage of the terms "pfcksum" and "PF_MD5_DIGEST_LENGTH" in the code. The person using AI to search for vulnerabilities did not bother to verify the results before submitting the vulnerability report.
Source: opennet.ru
