# DF-1310 — VERDICT

**REPRODUCED at the function level** (impact: `panic`).

## Mechanism

vtnet_rxeof() reads 'len' (signed int) from virtqueue_dequeue(). The lower-bound check at if_vtnet.c:1707 only drops tiny frames. The non-mergeable branch at :1720 performs 'len += VTNET_RX_HEADER_PAD' (2). If a malicious virtio device reports len = 0x7FFFFFFE, the addition wraps to INT_MIN (0x80000000). vtnet_replace_rxbuf() then runs 'while (len > 0)' — skipped for negative len — leaving m_prev == NULL. KASSERT(m_prev != NULL) at :1319 trips under INVARIANTS (panic); in production m_prev->m_next at :1334 is a NULL deref.

## Why not live-reproduced on the QEMU guest

The QEMU virtio_net device in the audit guest is a benign hypervisor; an unprivileged guest user (maxx) cannot make it emit crafted RX used-ring entries. The bug is real and reproducible against any malicious/compromised hypervisor (defense-in-depth / guest robustness), but not from within the guest.

## Recommended fix

Add an upper-bound check in vtnet_rxeof() before 'len += VTNET_RX_HEADER_PAD': if (len > VTNET_MAX_RX_SIZE + sc->vtnet_hdr_size) drop the frame (if_ierrors++, vtnet_discard_rxbuf, continue). This prevents the signed overflow that leads to KASSERT/NULL-deref in vtnet_replace_rxbuf.

## Kernel references (confirmed during verification)

- sys/dev/virtual/virtio/net/if_vtnet.c:1707 (lower-bound check only)
- sys/dev/virtual/virtio/net/if_vtnet.c:1720 (len += VTNET_RX_HEADER_PAD)
- sys/dev/virtual/virtio/net/if_vtnet.c:1296 (while (len > 0) loop)
- sys/dev/virtual/virtio/net/if_vtnet.c:1319 (KASSERT m_prev != NULL)
- sys/dev/virtual/virtio/net/if_vtnet.c:1334 (m_prev->m_next NULL deref)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`