# DF-1396 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

oce_get_profile_config (:2013-2023) and oce_get_func_config (:2103-2113): desc_count = HOST_32(fwcmd->params.rsp.desc_count) is a u32 from firmware response, unbounded. Loop walks nic_desc += nic_desc->desc_len (also FW-controlled u32) for desc_count iterations. resources[] is 22528 bytes (MAX_RESC_DESC*RESC_DESC_SIZE=256*88). desc_count>256 or desc_len>22528 walks past DMA buffer → OOB heap read / page fault. desc_count=0xFFFFFFFF causes ~4B iterations hang.

**Source:** `sys/dev/netif/oce/oce_mbox.c:2013-2023, 2103-2113`

## Why it cannot be reproduced on this guest

HW-gated. oce (Emulex OneConnect 10Gb) is in GENERIC but requires actual Emulex NIC hardware. No oce NIC in QEMU guest. Module auto-loads only if HW present.

## Phase 6: Escalation Assessment

This is a **HW-gated NIC (Emulex oce)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Cap desc_count <= MAX_RESC_DESC (256). Validate desc_len >= sizeof(struct oce_nic_resc_desc) before advancing pointer.

**Fix description:** Cap desc_count to MAX_RESC_DESC and validate desc_len minimum before pointer arithmetic.

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)