# PoC DF-1526: if_sf.c RX len OOB + DMA overflow

**Class:** Heap OOB read + DMA write overflow
**Cited site:** `sys/dev/netif/sf/if_sf.c:883,886,890,893,1169,951-952`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/netif/sf/if_sf.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

sf_newbuf sets m_len=pkthdr.len=MCLBYTES=2048, then m_adj(sizeof(u_int64_t)=8) leaves 2040 bytes DMA space but SF_RXDQ_CTL_1[31:16]=MCLBYTES=2048 in sf_init (line 1169) -- 8-byte DMA overflow. sf_rxeof m_devget(... cur_rx->sf_len + ETHER_ALIGN ...) with NO bound check on 16-bit sf_len (max 65535).

## Realistic impact ceiling (on suitable HW)

8-byte DMA overflow into next slab object + heap OOB read

## Fix

Clamp cur_rx->sf_len to MCLBYTES - sizeof(u_int64_t) - ETHER_ALIGN before the m_devget bcopy.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1526.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1526.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```