WAD Process Segfault in HTTP Chunked Transfer Decoding over Proxy Inspection
FortiOS proxy worker process /bin/wad panics with signal 11 (SIGSEGV) at wad_http_chunk_decode+0x7c when parsing malformed HTTP/1.1 chunked transfer trailers in explicit or transparent proxy inspection mode, terminating user web sessions.
Technical Root Cause Analysis
When FortiGate operates in proxy-based inspection mode (explicit proxy or proxy firewall policy with deep SSL inspection), the wad worker process parses incoming HTTP data streams to evaluate antivirus, DLP, and web filtering policies. For dynamic responses using HTTP/1.1 chunked encoding (Transfer-Encoding: chunked), the payload arrives in discrete chunks followed by an optional trailing header block.
In FortiOS builds 7.2.2 through 7.2.5, the chunked parsing function wad_http_chunk_decode assumes standard RFC trailer formatting and calculates offset buffers without bounds checking when handling oversized chunk extension headers or malformed trailers (>4096 bytes). This defect triggers a buffer overrun in user space, writing beyond the allocated chunk metadata slab. The resulting memory corruption causes a SIGSEGV (signal 11) kernel trap, forcing immediate worker termination and TCP connection reset for all sessions bound to that worker.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.5 | 7.2.6+ | Switch policies to Flow Mode or upgrade to 7.2.6+ |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Apply flow inspection profile |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | Legacy static parser unaffected by chunk trailer bug |
Platform Scope: Affects all hardware appliances and virtual machines running proxy inspection with deep SSL or antivirus scanning enabled. Hardware-accelerated flow-mode traffic bypasses WAD and remains completely unaffected.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these non-intrusive commands to verify whether WAD worker crashes have occurred and trace crashlog backtraces:
Diagnostic Commands
# 1. Inspect crashlog for WAD signal 11 crashes matching wad_http_chunk_decode
diagnose debug crashlog read | grep -A 6 -B 2 "wad"
# 2. Check current WAD worker process IDs and process memory usage
diagnose test application wad 1000
diagnose sys process pidof wad
# 3. View active proxy sessions and worker distribution
diagnose test application wad 106
# 4. Check system top memory to ensure workers are not leaking memory
diagnose sys top-mem 10Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
A missing buffer length validation in wad_http_chunk_decode causes a heap overrun when handling malformed or oversized HTTP chunked trailers, leading to a SIGSEGV signal 11 crash.
No. Only the specific worker process handling the malformed stream crashes. However, all active client connections managed by that worker are severed, and repeated crashes cause high CPU load during process respawns.
Converting firewall policies from proxy inspection mode to flow inspection mode completely circumvents the WAD HTTP chunked decoding subsystem while preserving IPS, Antivirus, and Web Filtering protection.