# PoC DF-1551: if_sn.c snread packet_length u_short underflow -> heap overflow

**Class:** Heap overflow write via unsigned wrap
**Cited site:** `sys/dev/netif/sn/if_sn.c:983,989,1005-1006,1016,1021,1037-1038`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/netif/sn/if_sn.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

packet_length = inw(BASE+DATA_REG_W) & RLEN_MASK (0x07ff, 0..2047). packet_length -= 6; assigned back to u_short, values 0..5 wrap to 65530..65535. RS_ERRORS filter only checks status bits not length. ODDFRAME+1 may further wrap 65535->0. m_len=packet_length=65530. MCLGET=2048 bytes. insw(BASE+DATA_REG_W, data, packet_length>>1) writes 32765 words=65530 bytes into 2KB cluster -> heap overflow write.

## Realistic impact ceiling (on suitable HW)

up to ~63KB kernel heap overflow write

## Fix

After the -= 6 subtraction, reject any packet_length > MCLBYTES (catches the unsigned wrap).

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1551.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1551.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```