{
  "finding_id": "DF-3581",
  "status": "untested",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "likely",
  "verdict": "Non-terminating RX processing loop in iwn_notif_intr(): the firmware-written closed_count is masked to 12 bits (0..4095, if_iwn.c:3900) but rxq.cur cycles modulo IWN_RX_RING_COUNT=64 (if_iwn.c:4056); any firmware value in [64,4095] can never equal cur, so the while loop at if_iwn.c:3901-4057 spins forever under the driver lock, wedging the machine (DoS, no panic). All indexing inside the loop stays in range, so this is a liveness defect, not memory corruption. Untestable on the virtio-only guest (needs an iwn device whose firmware emits an out-of-range closed_count); termination analysis is decidable from source, hence likely.",
  "exploit_chain": "malicious/buggy firmware writes closed_count >= 64 into the RX status DMA block -> iwn_notif_intr spins forever with sc_lk held -> hard hang.",
  "evidence": "VERDICT.md (termination analysis), fix.diff (mask to ring size), README.md.",
  "kernel_refs": [
    "sys/dev/netif/iwn/if_iwn.c:3900",
    "sys/dev/netif/iwn/if_iwn.c:3901",
    "sys/dev/netif/iwn/if_iwn.c:4056",
    "sys/dev/netif/iwn/if_iwnreg.h:29"
  ],
  "poc_changes": "none — no PoC authored; trigger needs iwn hardware absent from the guest.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Adjacent to the DF-1122/1123 trust boundary (firmware-fed values used unvalidated) but a distinct defect class (liveness) in the dispatcher itself.",
  "recommended_fix": "Mask closed_count to (IWN_RX_RING_COUNT-1) at if_iwn.c:3900, or bail out and reset the device on out-of-range values.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (ring-size mask); not validated — no runtime reproduction possible on this guest.",
  "fix_evidence": "findings/poc/DF-3581/fix.diff"
}