# DF-1131 — VERDICT

**Verdict: CONFIRMED via source-trace + userspace harness. On-guest: INCONCLUSIVE (HW-gated — no Broadcom bwn WiFi adapter on the QEMU guest).**

## Root-cause confirmation
`bwn_dma_rxeof()` validates the device-reported `frame_len` against the wrong
constant. `dr->dr_rx_bufsize` is set to `BWN_DMA0_RX_BUFFERSIZE = IEEE80211_MAX_LEN`
= **2312** (`if_bwn.c:2778`, `if_bwnreg.h:464`, `ieee80211.h:1297`), but the actual
RX buffer is an mbuf cluster of `MCLBYTES` = **2048** allocated by `m_getcl()`
(`if_bwn.c:5674`) with `m_len = MCLBYTES` (`if_bwn.c:5688`). The check at
`if_bwn.c:5486` (`if (len > dr->dr_rx_bufsize)`) therefore drops only `len > 2312`,
while any `len in (2018, 2312]` is kept and immediately produces
`m_len = len + dr_frameoffset` (`if_bwn.c:5512`, frameoffset=30) **greater than the
2048-byte cluster**. net80211 processes the mbuf reading up to `m_len` bytes from a
2048-byte backing cluster -> heap OOB read of up to `(2312+30-2048)=294` bytes.

## Evidence
- `harness.c` (run as unprivileged `maxx`) shows **4/7** `frame_len` values
  (2019, 2048, 2100, 2312) pass the kernel check but overrun the 2048-byte cluster
  by 1..294 bytes; a concrete model with `frame_len=2100` reads 82 OOB bytes of an
  adjacent heap marker.
- Full run: `run.log`. Build: `build.log`. Environment (no WiFi HW): `env.txt`.

## Exploit chain / impact
This is an **OOB read** (CWE-125), not a write primitive, so no `uid=0` chain.
Realistic impact ceiling: **kernel heap info leak up to ~294 bytes** per malicious
frame (the over-read bytes flow into the received 802.11 frame payload), or a
**panic** if the overrun reaches an unmapped page. AV:A, requires bwn hardware +
radio-range attacker.

## Fix validation
`fix.diff` extends the drop check to `(u_int)len + dr->dr_frameoffset > MCLBYTES`.
- `git apply --check -p1` => OK.
- Compiles in the GENERIC kernel build (`nativekernel` rc=0; `if_bwn.o` built clean).
- Harness "WITH FIX" pass: **0/7** OOB cases remain.
- `fix_status: not_testable` (HW-gated runtime; apply-check + compile + harness fix-demo + trace all pass).

## PoC changes
Evidence pack authored from scratch (seeded dir was empty): `harness.c`
(+ WITH-FIX pass), `build.sh`, `run.sh`, `fix.diff`, `VERDICT.md`, `manifest.json`, logs.

## Kernel refs (confirmed during verification)
`sys/dev/netif/bwn/bwn/if_bwn.c:2778`, `:5470`, `:5486`, `:5512`, `:5674`, `:5688`;
`sys/dev/netif/bwn/bwn/if_bwnreg.h:464`; `sys/netproto/802_11/ieee80211.h:1297`.