# DF-0998 — rum TX DMA buffer 16-byte overwrite

## Verdict
**NOT TESTABLE on default guest** (requires Ralink RT2573 USB WiFi adapter,
not present). Bug is real and confirmed by arithmetic review of the
descriptor/buffer layout; the fix.diff compiles cleanly as a KLD module
(see `module_build.log`).

## Mechanism (cited)

`rum_config[RUM_BULK_WR].bufsize = MCLBYTES + RT2573_TX_DESC_SIZE + 8`
= 2048 + 24 + 8 = **2080** bytes (`sys/bus/u4b/wlan/if_rum.c:438`).

`rum_bulk_write_callback()` at `sys/bus/u4b/wlan/if_rum.c:1028`:

```c
1057:   if (m->m_pkthdr.len > (int)(MCLBYTES + RT2573_TX_DESC_SIZE)) {
1058:       DPRINTFN(0, "data overflow, %u bytes\n", m->m_pkthdr.len);
1060:       m->m_pkthdr.len = (MCLBYTES + RT2573_TX_DESC_SIZE);   /* 2072 */
1061:   }
1062:   pc = usbd_xfer_get_frame(xfer, 0);
1063:   usbd_copy_in(pc, 0, &data->desc, RT2573_TX_DESC_SIZE);          /* TX desc at offset 0 (24 B) */
1064:   usbd_m_copy_in(pc, RT2573_TX_DESC_SIZE, m, 0, m->m_pkthdr.len); /* payload at offset 24 */
```

The TX descriptor is written at **offset 0** (24 bytes). The mbuf payload
is written starting at **offset 24**. The clamp at line 1057 allows
`m->m_pkthdr.len` up to `MCLBYTES + RT2573_TX_DESC_SIZE = 2072`.

End offset of the mbuf write = 24 + 2072 = **2096**, but the buffer is only
**2080** bytes. That is a **16-byte overwrite past the DMA buffer**.

`usbd_get_page` returns `(usb_size_t)-1` for the residual, so the USB layer
does not catch the overflow.

## Trigger path
The finding cites BPF raw injection via `ic_raw_xmit` (which a user with
`CAP_NET_RAW` or root can drive) or a high-MTU frame (>2025 bytes payload)
as the way to produce an mbuf with `m_pkthdr.len` large enough to hit the
overflow.

## Impact
- **Heap overwrite** of 16 bytes past the `RUM_BULK_WR` DMA buffer.
- Adjacent slab/heap object corruption; with grooming, potentially
  exploitable for privilege escalation (typical kmalloc-4096 or page
  bucket — exact bucket depends on the USB host-controller buffer
  allocator, which is in `sys/bus/u4b/`).
- `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H` (Medium as filed).

## Why not tested on the guest
Same as DF-0997: no `rum` USB device on the QEMU guest. The `if_rum.ko`
module is not loaded. Reproduction requires USB HW or a USB-gadget fuzzer.

## Fix
`fix.diff` — clamp `m->m_pkthdr.len` to `MCLBYTES` (not
`MCLBYTES + RT2573_TX_DESC_SIZE`). Then end-offset = 24 + 2048 = 2072 ≤
2080, comfortably inside the buffer (with 8 bytes of headroom for the
end-alignment padding at line 1082: `len = (RT2573_TX_DESC_SIZE +
m->m_pkthdr.len + 3) & ~3; if ((len % 64) == 0) len += 4;`).

## Compilation check
Fix (applied with DF-0997 and DF-0999) compiles cleanly into `if_rum.ko`.
See `module_build.log`.

## Files
- `fix.diff` — change clamp from `MCLBYTES + RT2573_TX_DESC_SIZE` to `MCLBYTES`
- `module_build.log` — proof the patched `if_rum.c` compiles
- `VERDICT.md`, `README.md`, `manifest.json`