# DF-1214 — vmxnet3 RX length unchecked vs cluster size

## Reproduce

Not runnable on the audit guest — no vmxnet3 NIC is attached (the guest uses
virtio-net). The verification is a static source trace + a compiling
`fix.diff`; see `VERDICT.md`.

To **validate the fix compiles**, after applying `fix.diff` to `/usr/src`:
```sh
cd /usr/src
make -j6 nativekernel KERNCONF=X86_64_GENERIC
```

## Bug location
`sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2216` — `length = rxcd->len`
(hypervisor-supplied, 14-bit) is written into `m->m_len` / `m->m_pkthdr.len`
at :2266 (HEAD, MCLBYTES-2 max) and :2300 (BODY, MJUMPAGESIZE max) with no
clamp. An oversized length makes `if_input()` read past the cluster into
kernel heap → guest info leak / corruption.

## Trigger preconditions (NOT met on this guest)
- A vmxnet3 NIC (VMware) that emits an RX completion with `len` exceeding the
  backing cluster size — i.e. a malicious or buggy hypervisor.

## Files
- `VERDICT.md`, `fix.diff`, `env.txt`, `build.log` (kernel-build excerpt).