# DF-1124 — Signed integer underflow + OOB read in iwn5000_rx_calib_results (Intel WiFi)

## Finding
`iwn5000_rx_calib_results` at `sys/dev/netif/iwn/if_iwn.c:3364`:
```c
len = (le32toh(desc->len) & 0x3fff) - 4;
```
- `len` is a signed `int`. If `(desc->len & 0x3fff) < 4`, underflows to
  negative → `kmalloc((size_t)len)` = huge → ENOMEM (caught at `:3396`).
- If firmware reports e.g. masked len = 16380, `len` = 16376; `kmalloc`
  succeeds, then `memcpy(sc->calibcmd[idx].buf, calib, len)` at `:3405`
  reads 16376 bytes from `calib = desc + 1` inside a 4 KiB RX mbuf → up to
  ~12 KiB OOB read (info leak / panic). The `calibcmd` buffer is later
  replayed to runtime firmware via `iwn5000_send_calibration`.

## Reachability on this guest
**NOT reachable.** No Intel WiFi adapter is present. `if_iwn.ko` is loadable
but never attaches. The bug requires buggy/compromised firmware or DMA
injection. Latent.

A userspace harness demonstrates both the underflow case and the OOB-read
case for various firmware-supplied lengths.

## Build / Run / Expected
```
cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: shows underflow (-4 → kmalloc(18446744073709551612)) and
#           OOB read (len=16376 from 4096-byte mbuf → 12288 bytes OOB)
```

## Files
- `harness.c` — demonstrates underflow and OOB-read for 4 firmware-length cases.
- `fix.diff` — adds `if (len < 0 || len > (int)(IWN_RBUF_SIZE - sizeof(*desc))) return;`.
- `build.log` / `run.log` / `env.txt` — captured outputs.