# DF-2322 — PoC verdict

**File:** `sys/bus/pci/pci.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

pci_setup_msix() validates the MSI-X table/PBA BAR resources exist and are RF_ACTIVE but never checks the mapped BAR sizes are large enough for msix_table_offset+msix_msgnum*16 (table) or msix_pba_offset+ceil(msgnum/8) (PBA). All three values come from device config space (attacker-controlled on a malicious device); vector writes/pending reads then run off the mapping.

### Cited lines

- `sys/bus/pci/pci.c:1637-1691`
- `sys/bus/pci/pci.c:1431-1453`
- `sys/bus/pci/pci.c:1483-1485`

## Why it does not reproduce on this guest

No MSI-X-capable PCI device on the QEMU guest. pciconf -lc on every device (PIIX3 host/isa/ata, virtio-net, virtio-blk, vgapci, none0) shows NO MSI/MSI-X capability. The bug requires a malicious PCI device advertising a large MSI-X table against a small BAR; none is present.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

In pci_setup_msix, after assigning table_res/pba_res, compute table_need=table_offset+msgnum*16 and pba_need=pba_offset+howmany(msgnum,8) and reject with ENXIO + clear the res pointers if either exceeds rman_get_size() of the respective BAR.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)