# DF-1205 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads from tulip_rombuf[128] at device attach

## Source Location
sys/dev/netif/de/if_de.c:2072-2336

## Verdict
Source-confirmed (complex fix): Unbounded SROM/EEPROM parsing in tulip_srom_decode causes OOB reads fr. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
tulip_srom_decode() at if_de.c:2072-2421 parses on-card EEPROM (tulip_rombuf[128]) using offsets/block counts/lengths directly from EEPROM with no bounds validation. sh_adapter_count (rombuf[19],0-255) unbounded at :2084 strides saip past rombuf. leaf_offset at :2107 ranges 0-65535, dp set at :2109 with no check < 128 -> immediate OOB. Block loops read lengths/counts at :2121/:2183/:2190 then advance dp += mi->mi_gpr_length (up to 255) at :2231/:2333 etc -> dp walks ~195KB into kernel memory. mi