# PoC DF-1509: bfe_set_rx_mode CAM index overflow on many multicasts

**Class:** HW register field overflow (DoS / HW misprogramming)
**Cited site:** `sys/dev/netif/bfe/if_bfe.c:868, 884, 893-895`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — bfe(4) is in GENERIC but only attaches to Broadcom BCM440x NICs (PCI ID 14e4:4401 etc.). Not present in audit guest. Trigger is SIOCADDMULTI x65+.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/netif/bfe/if_bfe.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 868 'int i = 0;' then line 884 'bfe_cam_write(sc, enaddr, i++);' and lines 890-895 TAILQ_FOREACH multicasts 'bfe_cam_write(..., i++);'. BFE_CAM_CTRL write at 857-858 encodes index in 'index << BFE_CAM_INDEX_SHIFT' but BFE_CAM_INDEX_MASK=0x003f0000 (6 bits, max index 63). After 64+ multicasts, i overflows the index field into adjacent control bits of the CAM_CTRL write. Result: CAM writes go to garbage indices, the BFE_CAM_BUSY wait spins, NIC drops traffic.

## Realistic impact ceiling

DoS / HW misprogramming

## Fix

Cap i at BFE_CAM_INDEX_MASK>>BFE_CAM_INDEX_SHIFT (63) inside the TAILQ_FOREACH; set ALLMULTI and break if exceeded.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1509.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1509.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/netif/bfe && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```