# DF-1292 — age (Attansic L1) RX descriptor-length race

## Verdict
**NOT REPRODUCED** — real source-level bug confirmed; **unreachable on this
guest** (no Attansic L1 NIC — only virtio-net).

## Mechanism (verified)
- `if_age.c:2025` — `age_newbuf(sc, rxd, 0)` recycles the descriptor.
- `if_age.c:2784-2785` — `age_newbuf` overwrites `desc->len` with the new buffer size in the LOW 16 bits.
- `if_age.c:2037` — `mp->m_len = AGE_RX_BYTES(le32toh(desc->len));` — `AGE_RX_BYTES` (`if_agereg.h:601-603`) extracts the HIGH 16 bits, which are now 0 ⇒ `m_len = 0` for non-first segments ⇒ `pktlen = 0`.
- `if_age.c:2061` — `pktlen -= ETHER_CRC_LEN;` ⇒ pktlen = -4.
- `if_age.c:2079` — `m->m_len = sc->age_cdata.age_rxlen - pktlen;` ⇒ `m_len = age_rxlen + 4` ≈ 9022 for a 9018-B jumbo frame on a 2046-B cluster ⇒ ~6976-B OOB read.

Root cause is unambiguous: the descriptor's receive length is read AFTER
`age_newbuf` has destroyed it. The fix is to snapshot the length before the
recycle.

## Why not triggered on this guest
- `pciconf -l` (env.txt): only virtio-net (vendor 1af4). No vendor-1969 Attansic device.
- `age` is in GENERIC but does not attach.

Phase 4(d): genuinely not reachable on this kernel. The bug is in a remote
attack surface (RX path of a Gigabit NIC) so it is realistically exploitable
**only on hardware that has an Attansic L1 NIC**; the audit guest is not such
a host.

## Fix
`fix.diff`:
1. Add `int segsz;` to `age_rxeof` locals.
2. Snapshot `segsz = AGE_RX_BYTES(le32toh(desc->len));` immediately after the
   `desc = rxd->rx_desc;` fetch, BEFORE `age_newbuf`.
3. Replace `mp->m_len = AGE_RX_BYTES(le32toh(desc->len));` with
   `mp->m_len = segsz;`.

This is the smallest change that preserves the buffer-recycle optimisation
while restoring correct length accounting.

## Fix validation
Compiles cleanly in the unified 5-fix kernel build (`fix_build.log`).
Runtime before/after is `not_testable` — no age NIC.

## Realistic impact
Remote OOB heap read of up to ~7 KB on a jumbo-frame `age` NIC. Likely panic
on INVARIANTS kernels; info disclosure on non-debug kernels.