# DF-1221 — ena RX req_id OOB index

## Reproduce

Not runnable on the audit guest — no Amazon ENA NIC is attached. The
verification is a static source trace + a compiling `fix.diff`.

To **validate the fix compiles** as a standalone module:
```sh
cd /usr/src/sys/dev/virtual/amazon/ena
make obj
make
ls /usr/obj/usr/src/sys/dev/virtual/amazon/ena/if_ena.ko
```

## Bug location
`sys/dev/virtual/amazon/ena/ena.c:1458–1459` — `req_id` (device-supplied
uint16) is used as an index into `rx_ring->rx_buffer_info[]` (sized
`ring_size` ≤ 1024) with no bounds check. The driver has `validate_rx_req_id()`
at :700 but does NOT call it on the RX-consume path (only TX-consume and
RX-refill). Out-of-range `req_id` reads up to ~4 MB OOB into kernel heap;
garbage `mbuf` pointer is dereffed+written at :1465.

## Trigger preconditions (NOT met on this guest)
- An Amazon ENA NIC (AWS EC2 Nitro) that emits an RX completion with
  `req_id >= ring_size` — i.e. a malicious/buggy/compromised device.

## Files
- `VERDICT.md`, `fix.diff`, `env.txt`, `module_build.log`.