# PoC DF-1490: epic_rx_done 16-bit rxlength has no upper-bound check

**Class:** heap OOB read (DMA-derived)
**Cited site:** `sys/dev/netif/tx/if_tx.c:582, 600`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — tx(4) (SMC EPIC/83c170) is in GENERIC but only attaches to SMC EtherPower II PCI NICs. Not present in audit guest.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/netif/tx/if_tx.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 582 `len = desc->rxlength - ETHER_CRC_LEN;` where desc->rxlength is volatile u_int16_t (0..65535). For rxlength<4, the int subtraction wraps to 65532..65534 (then truncates to u_int16_t back to 65532..65534). Line 600 `m->m_pkthdr.len = m->m_len = len;` assigns to the cluster mbuf with NO bound check vs MCLBYTES=2048. if_input then reads m->m_len bytes from a 2048-byte cluster → OOB heap read.

## Realistic impact ceiling

leak (info leak / DoS)

## Fix

Add `if (len > MCLBYTES) { IFNET_STAT_INC(ierrors); desc->status=0x8000; continue; }` between the rxlength computation and the mbuf assignment.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1490.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1490.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/netif/tx && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```