# DF-2604 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
The segsize==6 (group-of-4) path builds dlci from two full bytes (0..65535) and then executes an EMPTY if ((dlci < 1024) && (dlci > 0)) { /* XXX */ } body - a validation that validates nothing. The actual protection lives far away in nglmi_checkdata, which rejects dlci > 1023 before nglmi_rcvdata ever indexes sc->dlci_state[dlci] (size MAXDLCI+1 = 1024).

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain dead-body check; NOT a reachable OOB today (checkdata gate confirmed at the case 0x07/0x57 tail: dlci > 1023 -> goto reject). This corrects the framing of sibling DF-0564 (same file/lines, claimed reachable OOB - it is not, same gate). fix.diff implements the intended bounds check locally so rcvdata no longer relies on a distant validator; the identical empty body also exists in the netgraph v1 copy sys/netgraph/lmi/ng_lmi.c:698-704 (noted for the orchestrator to file separately if desired).

## Threat / reachability
Robustness: the only thing standing between a remote LMI peer and dlci_state[] is a validator in a different function.

## Privilege escalation assessment
n/a (hardening)

## Fix
Replace the empty body with a real guard: if (dlci > MAXDLCI) goto nextIE; in both the case-6 and case-3 arms.

## Kernel references
- `sys/netgraph7/lmi/ng_lmi.c:694`
- `sys/netgraph7/lmi/ng_lmi.c:708`
- `sys/netgraph7/lmi/ng_lmi.c:76`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.