# DF-1145 — Unbounded firmware-supplied MPDU length in iwm RX path (if_iwm.c)

**Status:** REPRODUCED at code level — **latent at runtime on this guest** (no WiFi HW).
**Severity (finding):** High · CWE-125 Out-of-bounds Read

## What the bug is
`iwm_rx_rx_mpdu` (`sys/dev/netif/iwm/if_iwm.c:3221`) takes
`len = le16toh(rx_res->byte_count)` (firmware-supplied, up to 65535) **without
any check** against the actual packet payload (`iwm_rx_packet_payload_len`,
`if_iwmreg.h:6944`) or the 4 KB RX cluster (`IWM_RBUF_SIZE`, `if_iwmvar.h:290`).
It then dereferences `pkt->data + sizeof(*rx_res) + len` (`:3222`) and sets
`m->m_len = len` (`:3251`), so `ieee80211_input` reads up to ~60 KB past the
cluster. `iwm_rx_mpdu_mq` (`:3342-3349`) is the same bug. Two `memcpy`s
(`iwm_rx_rx_phy_cmd:3102`, `iwm_handle_rx_statistics:3149`) also lack the
payload-length check. The `DTS_MEASUREMENT_NOTIFICATION` handler at `:5535`
*has* the correct check — proving the omissions are oversights.

## Why it does not trigger here
No WiFi adapter on the QEMU/KVM guest (`ifconfig -l` = `vtnet0 lo0`); `iwm`
is not in `X86_64_GENERIC`. Latent on Intel Wireless 7260/8000/9000/9260 HW.

## What was validated
1. **Source trace** confirmed (see VERDICT.md `kernel_refs`).
2. **Baseline** `if_iwm.ko` (incl. `if_iwm.o`) builds clean under `-Werror`.
3. **Fix** `fix.diff` applies (4 hunks) and patched `if_iwm.o` rebuilds clean
   under `-Werror` (`if_iwm.o`: 79584 -> 79776 bytes).

## Reproduce (compile-validation only)
```
scp this-folder/fix.diff root@guest:/root/df1145.diff
cd /usr/src && patch -p1 --forward < /root/df1145.diff
cd sys/dev/netif/iwm && rm -f if_iwm.o && make if_iwm.o   # -Werror clean
```

## Fix
`fix.diff` bounds each firmware length against `iwm_rx_packet_payload_len(pkt)`
and drops short payloads — mirroring the existing correct check at `:5535`.