# DF-2588 — PoC verdict

**File:** `sys/bus/u4b/wlan/if_urtwn.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

urtwn_rxeof loop guard if(len<sizeof(*stat)) compares signed int len against size_t sizeof. After 128-byte alignment rounding (totlen=(totlen+127)&~127; len-=totlen) len can go negative (-1..-127); implicit signed-to-unsigned promotion makes negative len a huge value, defeating the guard and reading stat->rxdw0 4 bytes past valid data.

### Cited lines

- `sys/bus/u4b/wlan/if_urtwn.c:969-985`
- `sys/bus/u4b/wlan/if_urtwn.c:1010-1013`

## Why it does not reproduce on this guest

No Realtek RTL8188CU/RTL8188EU USB wifi adapter on the QEMU guest (usbconfig list shows no devices; no urtwn interface).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Change the guard to check both signs: if (len <= 0 || (unsigned)len < sizeof(*stat)) break;.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)