# DF-3428 VERDICT — rxsync reserved-overflow livelock

**status: build_failed | reproduced: 0 | impact: none (not exercisable) | finding severity: Medium (local DoS, source-certain)**

## Reproduced?
No — netmap KLD unbuildable on this tree (see `netmap_build.log`). The
arithmetic, however, is fully determined:

```
resvd = ring->reserved   // user-writable u_int32 (netmap.h:223, mmap'd)
resvd = 0xFFFFFFFF, ring->avail = 1
resvd + ring->avail      // netmap_generic.c:694, 32-bit: == 0
0 >= lim + 1 (1024)?     // NO -> check passes, resvd NOT reset
k = ring->cur = 0        // validated <= lim at :643
k < resvd  ->  k = k + lim + 1 - resvd   // :698, mod 2^32
          =  0 + 1024 + 1 - 4294967295
          =  1026  (> lim = 1023)
for (n = 0; j != k; n++) // :702; j ∈ [0..1023] forever, k = 1026
```

Every slot write in the loop is in-bounds (`slot[j]`, j wraps at lim) — this
is a pure livelock of the calling thread while it holds the kring
(`nm_kr_get`/`q_lock` via `netmap.c:1474` NIOCRXSYNC or `:1768` poll),
wedging the ring and pinning the CPU at 100% in-kernel; the thread cannot be
killed (never sleeps).

## Why the wrap check fails
`:694` `if (resvd + ring->avail >= lim + 1)` performs the sum in 32-bit
`u_int`; two attacker-chosen large values wrap to a small one and bypass the
"invalid reserve" reset. The subtraction at `:698` then underflows k out of
the `[0, lim]` range the loop can never reach.

Sibling check: `netmap_rxsync_from_host` (`netmap.c:886-930`) has the same
32-bit wrap but computes only deltas (`n = k >= j ? k-j : k+lim-j`) — no
loop, so only userspace-visible accounting is corrupted there. The infinite
loop is unique to `generic_netmap_rxsync` (`netmap_generic.c:700-711`).

## Fix
Validate `resvd` against `lim` before use (it can never legitimately exceed
the slot count); see `fix.diff`.  `not_testable` (module unbuildable).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.