# DF-2339 — PoC verdict

**File:** `sys/bus/u4b/net/if_cue.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

cue_setmulti sizes the local hash table to 8 bytes (uint8_t hashtbl[8]) but CUE_BITS=9 makes cue_mchash return 0..511 for the device 512-bit/64-byte table (if_cuereg.h:96). hashtbl[h>>3] therefore indexes 0..63 into an 8-byte stack array (up to 56 bytes past end); broadcast hashes to 255, so it overflows deterministically.

### Cited lines

- `sys/bus/u4b/net/if_cue.c:273-283`
- `sys/bus/u4b/net/if_cue.c:311`
- `sys/bus/u4b/net/if_cue.c:329`
- `sys/bus/u4b/net/if_cue.c:338`
- `sys/bus/u4b/net/if_cuereg.h:96-100`

## Why it does not reproduce on this guest

No CATC EL1210A USB-ethernet adapter on the QEMU guest (usbconfig list shows no devices; only ehci/xhci host-controller modules loaded; no /dev/cue*).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Add CUE_HASH_TABLE_LEN=64, size hashtbl[CUE_HASH_TABLE_LEN], fill 64 bytes in the ALLMULTI branch, and write 64 bytes via cue_mem.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)