# DF-1123 — VERDICT

## Verdict
**SOURCE-CONFIRMED (real bug), NOT REPRODUCED AT RUNTIME on this guest.**
The missing upper bound on the firmware-reported frame length is traced
line-by-line in compiled module source. It does not fire here because the iwn
driver never attaches (no Intel WiFi HW). Dormant code path, **not** a false
positive (`if_iwn.ko` ships in `/boot/kernel`).

## Mechanism (source trace)
`iwn_rx_done` (`sys/dev/netif/iwn/if_iwn.c:3036-3157`) processes an RX_DONE /
MPDU_RX_DONE firmware notification (RX interrupt path):
- `:3080` `len = le16toh(mpdu->len);` or `:3081` `len = le16toh(stat->len);` —
  firmware-reported 16-bit frame length.
- `:3084` `flags = le32toh(*(uint32_t *)(head + len));` — reads 4 bytes at
  `head + len`. `head` sits inside `data->m`'s `IWN_RBUF_SIZE` (4096, `if_iwnreg.h:54`)
  DMA cluster. There is **no upper bound** on `len`, so a buggy/hostile firmware
  reporting `len` up to 65535 reads up to ~60 KB past the 4 KB cluster (heap OOB read).
- `:3098` the only length check is a **lower** bound: `len < sizeof(struct
  ieee80211_frame_ack)` (10 bytes) — discards too-short frames but never too-long.
- `:3156-3157` `m->m_data = head; m->m_pkthdr.len = m->m_len = len;` fabricates
  an mbuf claiming a ~60 KB body inside a 4 KB cluster, so `ieee80211_input`
  (`:3231`) walks attacker-influenced-size bytes → heap info leak or panic.

Trigger: a firmware/PHY event misreporting the RX length (firmware bug or
DMA injection by a hostile radio). There is no userspace syscall trigger.

## Why not reproduced here
No Intel Wireless (iwn) hardware; `if_iwn.ko` **not loaded** and never attaches;
the RX path is dead. Cannot be synthesized without the NIC.

## Fix
`fix.diff` adds an explicit upper bound before the FCS read: reject if
`len > IWN_RBUF_SIZE` or `head + len + sizeof(uint32_t)` would exceed
`mtod(data->m) + IWN_RBUF_SIZE` (the cluster end), bumping `ic_ierrors` and
returning. **Matches** the finding's proposal (check `head+len+4` against the
RX buffer size).

## Fix validation (compile)
**Applies** (`git apply --check` clean) and **compiles**: `if_iwn.ko` rebuilt
from patched source (with DF-1122's fix also applied) under `-Werror`,
`if_iwn.c` compiled clean, rc=0. Runtime before/after is **not_testable** (no
iwn HW; the trigger is a firmware/radio event that cannot be synthesized here).

## Exploit chain
None — the primitive is firmware/radio-triggered and unreachable at runtime on
this guest; impact ceiling is OOB heap read / fabricated-mbuf info leak or panic
on a HW-equipped host.