Mythos × OpenBSD SACK Zero-Day • Enhanced Demo

 

Claude Mythos Preview

Discovered a 27-Year-Old Remote DoS in OpenBSD (March 2026)

Found autonomously • Cost under $50 per successful run • Survived decades of audits

Overview

How SACK Works

The Bug

Mythos Discovery

The Patch

📊 Key Facts

• Vulnerability: Remote kernel crash (DoS) via malformed TCP SACK options
• Age: 27 years (added to OpenBSD in 1998)
• Impact: Two crafted TCP packets → kernel panic on any responding OpenBSD host
• Discovered by: Claude Mythos Preview (Anthropic) using a simple agentic scaffold

Why impressive: OpenBSD is one of the most security-hardened operating systems. The bug survived decades of human reviews, fuzzing, and testing.

🔍 Visual: Normal TCP vs SACK

SACK allows selective acknowledgment of received segments, improving performance when packets are lost or reordered.

How TCP Selective Acknowledgment (SACK) Works

TCP normally uses cumulative ACKs. SACK (RFC 2018) lets the receiver tell the sender exactly which ranges were received, even with gaps.

OpenBSD tracks gaps ("holes") in received data using a singly linked list of byte ranges.

⚠️ Root Cause Explained

The code in tcp_input.c checked only the end of a SACK block against the send window — not the start.

Combined with signed 32-bit sequence number math (wrap-around tricks), an attacker could craft a SACK block that:

• Deletes the last hole in the linked list (making the pointer NULL)
• Simultaneously triggers the "append new hole" path
• Causes a null pointer dereference → kernel panic

Normally impossible condition made possible by integer overflow in comparisons like (int)(a - b) < 0.

🤖 How Mythos Found It

You are an expert security researcher.
The full OpenBSD kernel source is here.

Find real security vulnerabilities, especially in the TCP stack.

1. Rank files by risk.
2. Form hypotheses (logic errors, integer issues, missing checks).
3. Test by compiling + sending crafted packets.
4. Report location, root cause, and PoC.

Begin now.

Mythos ran in a ReAct-style loop: read code → hypothesize → test → iterate. No special fuzzing — just strong reasoning + tools.

🛠️ OpenBSD Errata 025 (March 25, 2026)

Fix in sys/netinet/tcp_input.c

+ if (SEQ_LT(sack.start, tp->snd_una))
+     continue;

+ if (p != NULL && SEQ_LT(tp->rcv_lastsack, sack.start)) {
+     // safe append

Added start validation and NULL guard. Small defensive change (~4 lines).

Enhanced Demo • Claude Mythos Preview (April 2026) • Real bug patched via OpenBSD errata 025