# PoC DF-1517: if_ath_rx.c rs->rs_datalen OOB mbuf length

**Class:** Heap OOB read (12-bit DMA len on 2048-byte cluster)
**Cited site:** `sys/dev/netif/ath/ath/if_ath_rx.c:730,760-766,773,885`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/netif/ath/ath/if_ath_rx.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

ath_legacy_rxbufinit allocates MGETHDR+MCLGET=2048 cluster and programs HAL with 2048 (331-334). On RX HAL sets rs_datalen from AR_DataLen=0x00000fff (12-bit, max 4095). ath_rx_pkt at 730/760-766/773 sets m->m_len=len with NO upper bound check vs MCLBYTES/ext_size. Only lower-bound check len<IEEE80211_MIN_LEN at 885. Trigger: monitor VAP active + crafted RX descriptor.

## Realistic impact ceiling (on suitable HW)

kernel heap OOB read up to 2047 bytes past cluster

## Fix

Reject rs->rs_datalen > MCLBYTES in ath_rx_pkt before assigning to m_len.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1517.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1517.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```