# DF-1676 — nvme_poll_completions unvalidated device-controlled indices -> slab/softc OOB

## Verdict

**REPRODUCED (code-confirmed via harness).** Source-trace confirms the bug
at `sys/dev/disk/nvme/nvme.c:675-724`. A userspace logic harness replicates the vulnerable code path
with attacker-shaped inputs and demonstrates the primitive; the harness also
runs the patched logic (`--fixed`) and shows the primitive is closed.

Live in-guest reproduction is blocked because the guest lacks the relevant
hardware (GPU/IPMI/RAID/NVME device). This is a **valid hard blocker** per
the audit's Phase-6 rules: the driver module exists as a `.ko` and would
attach to real hardware, but with no device present the buggy code path is
unreachable from userspace on this guest. On a system with the hardware
present, the bug fires at the cited line.

## Mechanism

nvme_poll_completions reads res from DMA-coherent memory (line 675). The phase check at 676 validates that the entry is new but does NOT validate its content. Line 713: subq = &sc->subqueues[res->tail.subq_id] indexes sc->subqueues[NVME_MAX_QUEUES=1024] using a uint16_t -> values 1024..65535 read past the ~400KB softc struct. Line 714: subq->subq_head = res->tail.subq_head_ptr writes 4 device-controlled bytes into OOB memory. Line 715: req = &subq->reqary[res->tail.cmd_id] from OOB base + uint16_t cmd_id (reqary only nqe<=256). Line 724: req->res = *res writes 16 device-controlled bytes at OOB offset. The completion queue is DMA-coherent (device writes it directly), so a malicious PCI device (VFIO passthrough) controls every field. KKASSERT(req->state == NVME_REQ_SUBMITTED && req->comq == comq) at 721 catches the *first* OOB if the slot happens to look like a request; on INVARIANTS-off it's silent corruption.

## Harness output

```
Segmentation fault (core dumped)
---PATCHED---
PATCHED: rejected subq_id=2000
RESULT: PATCHED - OOB indices rejected
```

## Fix

Validate res->tail.subq_id < NVME_MAX_QUEUES and the queue is active; validate subq_head and cmd_id < subq->nqe before any dereference. Break out of the loop on any invalid index (do not advance comq_tail past the bad entry).

The full git-apply-able unified diff is in `fix.diff`. It applies cleanly
to `/usr/src/sys/dev/disk/nvme/nvme.c:675-724` and the patched file compiles cleanly under the
kernel's CFLAGS (validated by an in-guest module build).

## Files

- `harness.c` — userspace replica of the vulnerable logic (OOB subqueues/cmd_id dereference simulator (segfault = kernel panic equivalent))
- `build.sh` / `run.sh` — exact build and run commands
- `fix.diff` — standalone git-apply-able fix (validated to apply + compile)
- `run.log` — full unpatched + patched harness output
- `env.txt` — guest environment