The vulnerability arises from the ARP input handlers arpintr() and in_arpinput() not validating the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets in DragonFly BSD versions up to 6.4.2. This unchecked validation allows an attacker to craft an ARP request that specifies arbitrary length values, which are then used as memcpy lengths in in_arpreply(). As a result, up to approximately 250 bytes of kernel heap and stack memory—including kernel pointers—can be read and returned in the ARP reply, leading to sensitive information disclosure. This flaw maps to CWE-130, a data conversion error where untrusted input influences buffer lengths.

DragonFly BSD distributions from the stable series up to 6.4.2, inclusive, are affected by this flaw. The issue persists until the 6.6 stable release is released or until the commit 4bb22ffcf2e9fb44995fbfd9945194afc87fb182 is applied to a system's code base. Any system running these vulnerable versions and exposed to an adjacent network is susceptible.

The CVSS score of 7.1 reflects a significant impact, and although no EPSS score is currently available, the absence of a KEV listing does not reduce the urgency. A remote unauthenticated attacker on the same local network can trigger the flaw with a single crafted ARP request; the exploit is straightforward and does not require elevated privileges or special software. The read gadget may aid subsequent attacks by exposing kernel memory structures, thereby raising the potential for privilege escalation or code execution if exploited in combination with other vulnerabilities.