# PoC DF-1452: ae_rxeof lacks upper-bound check on NIC-controlled rxd->len

**Class:** heap OOB read (DMA-derived length)
**Cited site:** `sys/dev/netif/ae/if_ae.c:609-616`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — ae(4) is in GENERIC but only attaches to Attansic/Atheros L2 Fast Ethernet PCI NICs (PCI ID 1969:2048). Not present in the audit QEMU guest; trigger is a malicious NIC DMA-ing len=0xFFFF into the RX descriptor.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/netif/ae/if_ae.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 609 `size = le16toh(rxd->len) - ETHER_CRC_LEN;` — rxd->len is u16 from NIC DMA. Only lower-bound (runt) is checked; no upper bound. rxd->data is fixed 1528 bytes (if_aevar.h:73). With len=0xFFFF, size=65531 and `m_devget(&rxd->data[0], size, ...)` (line 616) copies 65531 bytes from a 1528-byte buffer → ~64KB OOB heap read past the DMA allocation, leaking kernel memory into the mbuf and onward to userspace via if_input.

## Realistic impact ceiling

leak (info-leak / DoS)

## Fix

Add `if (size > sizeof(rxd->data))` upper-bound check between the runt check and m_devget; drop and report EIO on violation.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1452.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1452.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/netif/ae && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```