# DF-1880 PoC

Trigger: join 64 multicast groups via `setsockopt(IP_ADD_MEMBERSHIP)` on
a host with an oce(4) NIC. `oce_hw_update_multicast` loops the multicast
list with a bound of `OCE_MAX_MC_FILTER_SIZE` (64) but the destination
array `mac[]` has only 32 slots, causing a 192-byte heap OOB write.

## Preconditions

* `device oce` (Emulex OneConnect NIC present).
* No special privileges — `IP_ADD_MEMBERSHIP` is unprivileged.

## Build

```
cc -o poc poc.c
```

## Run

```
./poc    # as any unprivileged user
```

## Expected output

```
panic: vm_fault / bad free list / slab corruption
backtrace through oce_hw_update_multicast -> bcopy
```

## Fix

See the finding markdown: change the loop bound from
`OCE_MAX_MC_FILTER_SIZE` (64) to `nitems(req->params.req.mac)` (32),
matching the actual array size.