# PoC DF-1478: my_rxeof FLNG has no upper-bound check vs MCLBYTES

**Class:** heap OOB read (DMA-derived length)
**Cited site:** `sys/dev/netif/my/if_my.c:1105-1131`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — my(4) is in LINT64 only (not in GENERIC). Myson MTd80x/MTD89x PCI NIC needed; not present in audit guest.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/netif/my/if_my.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1105 `total_len = (rxstat & MY_FLNGMASK) >> MY_FLNGShift;` — FLNG is 12-bit (0..4095). Line 1106 subtracts ETHER_CRC_LEN. RX cluster is MCLBYTES=2048 (programmed as RBS=MCLBYTES-1 at 1076). For FLNG in [2053,4095], total_len 2049..4091 exceeds 2048. Line 1110 m_devget(..., total_len, ...) and line 1131 `m->m_len = total_len` both operate on a length > the cluster size → OOB heap read of up to ~2KB past the cluster.

## Realistic impact ceiling

leak (info leak / DoS)

## Fix

Add `if (total_len > MCLBYTES) { drop; continue; }` between the FLNG extraction and the m_devget/newbuf path.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1478.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1478.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/netif/my && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```