# DF-1395 — oce_read_mac_addr firmware-controlled heap overflow (PoC)

## Summary
`oce_read_mac_addr` (`sys/dev/netif/oce/oce_mbox.c:447-449`) copies a firmware
MAC address using a firmware-controlled `size_of_struct` (u16, unchecked) into
the 6-byte `mac->mac_addr`, overflowing into adjacent softc fields
(`bsmbx`, `bmbx_lock`, `wq[]`/`rq[]`/`cq[]`/`eq[]`). Malicious/buggy OneConnect
HBA firmware. `device oce` is in `X86_64_GENERIC` (ships in the default kernel).

## Reachability
`oce(4)` attaches only to Emulex OneConnect 10Gb PCI HBAs. The QEMU audit guest
has no such hardware, so the bug is **not live-reachable here**. This package
proves the primitive deterministically with a byte-exact userspace harness that
replicates the exact `struct mac_address_format` layout and the vulnerable
`bcopy(... size_of_struct)` logic.

## Build / run
```sh
./build.sh && ./run.sh      # builds & runs the harness as an unprivileged user
```

## Expected output (bug present)
```
FW-controlled size_of_struct = 64 (0x40)
overflow past mac_addr[6]: YES -> into adjacent softc fields
adjacent softc canary corrupted: YES
OVERFLOW CONFIRMED: FW-controlled size_of_struct (64) bypassed the 6-byte mac_addr ...
```
On a fixed kernel the overflow is impossible by construction (the clamp bounds
the copy to `sizeof(mac->mac_addr)` = 6).

## Files
- `oce_overflow.c` — byte-exact harness (struct from `oce_hw.h:1051-1053`).
- `build.sh` / `run.sh` — exact build/run.
- `run.log` — decisive harness output.
- `env.txt` — guest uname / cc version.
- `fix.diff` — git-apply-able fix (clamp copy length to `sizeof(mac->mac_addr)`).
- `fix_build.log` — full untrimmed kernel build log with the fix (rc=0, `-Werror`).
- `VERDICT.md` — full analysis.
- `manifest.json` — artifact catalog.

## Fix
Clamp `mac->size_of_struct` to `sizeof(mac->mac_addr)` before the `bcopy`
(`fix.diff`). Validated to compile into a rebuilt `X86_64_GENERIC` kernel.