# PoC DF-1514: if_ste.c RX total_len OOB read

**Class:** Heap OOB read (DMA-controlled length)
**Cited site:** `sys/dev/netif/ste/if_ste.c:678,695`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/netif/ste/if_ste.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

ste_rxeof reads total_len = cur_rx->ste_ptr->ste_status & STE_RXSTAT_FRAMELEN (a 13-bit DMA-coherent field, 0..8191) with NO bound check. The RX cluster is MGETHDR+MCLGET (2048 bytes) + m_adj(ETHER_ALIGN=2) leaving 2046 usable bytes. m->m_pkthdr.len = m->m_len = total_len at line 695; for FRAMELEN in [2047..8191], ether_input/ip_input walks up to ~6145 bytes past the cluster into kernel heap.

## Realistic impact ceiling (on suitable HW)

kernel heap info leak + panic; sibling of DF-1410

## Fix

Clamp total_len to MCLBYTES - ETHER_ALIGN before assigning to m_len/m_pkthdr.len.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1514.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1514.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```