# PoC DF-1481: vr_rxeof VR_RXBYTES has no upper-bound check vs MCLBYTES

**Class:** heap OOB read (narrow, DMA-derived)
**Cited site:** `sys/dev/netif/vr/if_vr.c:1005-1017`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — vr(4) is in GENERIC but only attaches to VIA Rhine NICs (PCI ID 1106:3065 etc.). Not present in audit guest; trigger is a malicious Rhine NIC.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/netif/vr/if_vr.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1005 `total_len = VR_RXBYTES(cur_rx->vr_ptr->vr_status);` — VR_RXBYTES extracts 11-bit (0..2047, vr_status bits 16..26). Line 1014 subtracts ETHER_CRC_LEN (4). For RXLEN in [2045,2047] → total_len 2041..2043. Line 1016 `m_devget(mtod(m, char *) - ETHER_ALIGN, total_len + ETHER_ALIGN, ...)` reads total_len+2 bytes from the cluster (MCLBYTES=2048) starting at offset -2, reading 1-3 bytes past the cluster into adjacent heap.

## Realistic impact ceiling

leak (narrow info leak / DoS)

## Fix

Add `if (total_len > MCLBYTES - ETHER_CRC_LEN) { drop; continue; }` after the VR_RXBYTES extraction.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1481.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1481.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/netif/vr && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```