# DF-1351 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
nfe_rxeof accepts NIC-reported frame length without bounds check; FIXME workaround can underflow to -1

## Source Location
sys/dev/netif/nfe/if_nfe.c:1072-1126

## Verdict
Source-confirmed (complex fix): nfe_rxeof accepts NIC-reported frame length without bounds check; FIXM. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
nfe_rxeof at if_nfe.c:1078-1126: len=le16toh(desc->length)&0x3fff (int 0-16383). FIXME workaround len-- at :1095/1103 with no len>0 guard. m_len=m_pkthdr.len=len at :1126 with no check vs ring->bufsz (MCLBYTES=2048 std, NFE_JBYTES=9020 jumbo). len>bufsz -> OOB read. len=0+FIXME -> m_len=-1 -> stack invariants broken. Not network-triggerable on compliant NIC (DMA bounded by descriptor length). Buggy nForce MCP silicon mis-reports lengths (FIXME exists for this). Fix: check len>=ETHER_HDR_LEN && l