# DF-1157 — PoC evidence pack

**`wpi_rx_done` reads `tail` and sets `m_len` from unbounded firmware `head->len`
(OOB heap read / oversized mbuf) — `sys/dev/netif/wpi/if_wpi.c:1968-2028`.**

`head->len` (firmware `uint16_t`, no upper bound) is used to compute `tail =
(head+1)+len` and dereference `tail->flags` at `:1970` **before** the
lower-bound check at `:1984`. The RX buffer is `MJUMPAGESIZE=4096`, so a large
`len` makes `tail` point past the cluster (OOB heap read), and `m_len=len`
hands an oversized mbuf to `ieee80211_input`. wpi twin of DF-1123 (iwn).

## Status
Source-confirmed. **NOT reproduced at runtime on this guest**: `wpi` IS compiled
into `X86_64_GENERIC:272`, but the RX handler only runs on an Intel 3945ABG
adapter, and the guest has no WiFi hardware. No standalone harness (the path is
not syscall-reachable).

## Reproduce (source-level + fix)
```
./build.sh          # documents the fix-validation (combined nativekernel build)
./run.sh            # documents the runtime-unreachable status
```
See `VERDICT.md` for the source-level confirmation.

## Fix
`fix.diff` upper-bounds `head->len` against the RX cluster right after it is
read, before `tail` is computed/derefed. Validated: applies + compiles clean in
a combined single-fix kernel (`if_wpi.o`, `-Werror`); boots `#1`; the bound
check is unconditional. See `VERDICT.md` / `fix_validation.txt`.