# DF-1248 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and lengths

## Source Location
sys/dev/netif/dc/if_dc.c:1744-1823

## Verdict
Source-confirmed (complex fix): SROM/EEPROM parsing unbounded OOB heap reads via unchecked offsets and. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
dc_parse_21143_srom at if_dc.c:1780-1823: loff=sc->dc_srom[27] unchecked used as index into SROM (128-8192B). Leaf header deref at loff OOB. Block walk: ptr+=(hdr->dc_len&0x7F)+1 per block, dc_mcnt up to 255, no bounds -> ptr advances up to 32KB past buffer. dc_decode_leaf_mii: p+=2*dc_gpr_len (up to 510B) -> OOB-derived m->dc_reset_ptr/dc_gp_ptr. dc_apply_fixup iterates OOB pointers in loops writing to DC_WATCHDOG. Sibling of DF-1205 (if_de.c SROM OOB). Malicious PCI device EEPROM. Fix: store d