# DF-1222 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
RX descriptor length not clamped to receive buffer size (OOB heap read / mbuf length overflow)

## Source Location
sys/dev/virtual/amazon/ena/ena.c:1457-1509

## Verdict
Source-confirmed: RX descriptor length not clamped to receive buffer size (OOB heap read. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
ena_rx_mbuf() at ena.c:1457/1466-1467: len=ena_bufs[buf].len (uint16 0-65535) set to mbuf->m_pkthdr.len/m_len without clamping to cluster size. RX buffers allocated with MJUMPAGESIZE=4096 or MCLBYTES=2048 (:915/:921). len>4096 -> mbuf claims more data than buffer -> network stack reads past cluster into adjacent kernel heap -> info leak. Multi-desc path m_append(mbuf,len,...) at :1509 copies len bytes from 4096-byte source. Malicious/buggy ENA device sets length=0xFFFF. Fix: clamp len to rx_info