# DF-0616 — PoC: netmap generic rxsync heap buffer overflow

Heap buffer overflow (CWE-787) in `generic_netmap_rxsync()`:
`m_copydata(m, 0, len, addr)` copies an RX mbuf of attacker-controlled length
`len = m->m_pkthdr.len` (jumbo/LRO frame, up to ~64 KB) into a fixed **2048-byte**
netmap buffer with **no bounds check**, writing thousands of attacker-controlled
bytes into the adjacent netmap pool / kernel heap.

The TX path at `netmap_generic.c:500` **does** validate `len > NETMAP_BUF_SIZE`;
the RX path at `:672-674` does not — the omission this finding reports.

## Files

- `df0616_harness.c` — **code-level proof** (the accepted form for this audit).
  Replicates verbatim `MBUF_LEN` (`netmap_kern.h:52`), `m_copydata`
  (`uipc_mbuf.c:1671-1696`), and the vulnerable RX block
  (`netmap_generic.c:672-674`). `-DFIX` inserts the proposed clamp.
- `poc_rxsync_overflow.c` — original runtime-trigger scaffold (needs a live
  netmap-mode NIC + remote jumbo sender; infeasible on this guest — kept for
  reference).
- `fix.diff` — git-apply-able clamp mirroring the TX-side check at `:500`.
- `build.sh` / `run.sh` — exact repro.
- `VERDICT.md` — full narrative incl. fix before/after.
- logs: `build.log`, `run.log`, `run.2.log`, `run.3.log`, `fix_run.log`,
  `fix_build.log`, `env.txt`.

## Build & run

```
./build.sh                       # builds df0616_harness + df0616_harness_fixed
./run.sh 9000                    # 9000-byte jumbo frame (default); try 65535 for LRO-max
```

## Expected outcome

- **Vulnerable logic** (`df0616_harness 9000`):
  `OOB WRITE CONFIRMED: 6952 bytes corrupted past the 2048-byte buffer` — the
  corrupted adjacent-pool bytes are attacker-controlled (`0x41+` pattern).
- **Patched logic** (`df0616_harness_fixed 9000`):
  `No OOB write ... FIX HOLDS: overflow prevented (clamped).`

## Why a code-level harness (not runtime)

The runtime netmap path is unavailable on this master-DEV guest: netmap is not
in `X86_64_GENERIC`, the KLD module no longer compiles (`struct ifnet` dropped
`if_unused7`, which `netmap_kern.h:747` `WNA()` needs), and QEMU SLIRP caps the
path MTU at 1500. The harness reproduces the **verbatim audited logic** and is
the accepted proof per the DF-0265/DF-0594 precedent. See `VERDICT.md` §3.