# DF-1373 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
oce_check_ipv6_ext_hdr parses IPv6 ext header without m_pullup (OOB read on short TX mbuf)

## Source Location
sys/dev/netif/oce/oce_if.c:2167-2241

## Verdict
Source-confirmed (complex fix): oce_check_ipv6_ext_hdr parses IPv6 ext header without m_pullup (OOB re. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
oce_check_ipv6_ext_hdr at oce_if.c:2167-2183: reads eh->ether_type(+12), ip6->ip6_nxt(+20+14=34), ip6e->ip6e_len(+55) without m_pullup or m_len check. Short TX mbuf (<62 bytes) with IPv6+ext headers -> reads past m_len. Called from oce_tx on every TX. Local raw socket or BPF write. Fix: m_pullup(needed) before reads.