# DF-3629 VERDICT

**Status: inconclusive (kernel path not exercisable — no iwm hardware on
guest). Confidence in the defect: certain (source-level).**

## What was verified

1. **Source trace (certain).** `iwm_handle_rxb()` dispatches firmware
   notifications on `pkt->hdr.code` with no validation of
   `pkt->hdr.qid`/`pkt->hdr.idx`
   (`sys/dev/netif/iwm/if_iwm.c:5385-5455`). For `IWM_TX_CMD` it calls
   `iwm_rx_tx_cmd(sc, pkt)` (`:5453-5455`), which immediately does
   `ring = &sc->txq[qid]; txd = &ring->data[idx];`
   (`:3598-3604`). `sc->txq[]` has `IWM_MAX_QUEUES == 31` elements
   (`sys/dev/netif/iwm/if_iwmreg.h:1923`, `sys/dev/netif/iwm/if_iwmvar.h:447`);
   `qid` is a raw `uint8_t` copied from device-DMA'd memory. Values 31..255
   are out of bounds. The function then *writes* through the OOB `txd`
   (`txd->done = 1; txd->m = NULL; txd->in = NULL;` at `:3620-3622`),
   decrements OOB `ring->queued` (`:3627`), shifts `1 << qid` with qid ≥ 32
   (undefined behavior, `:3626-3628`), and passes the wild `in` pointer into
   `iwm_rx_tx_cmd_single()` (`:3612`, derefs `:3480-3483`) and
   `ieee80211_tx_complete()` (`:3624`). `idx` itself cannot overflow
   (`uint8_t < IWM_TX_RING_COUNT == 256`), the bug is the missing `qid`
   bound.
2. **Guest reality (why not reproduced).** DragonFly 6.5-DEVELOPMENT guest:
   `if_iwm.ko` exists and `kldload if_iwm` succeeds, but there is **no
   Intel Wireless PCI device** — the driver attaches to nothing, no wlan
   interface exists, and no RX/TX completion path can ever run
   (env.txt). Triggering requires either an iwm NIC whose firmware emits a
   TX completion with a bogus qid, or an attacker-controlled PCIe device
   presenting an iwm PCI ID.

## Exploit chain (for the class)
malicious/errant firmware (or hostile PCIe device) -> DMA an RX buffer whose
packet header has code=IWM_TX_CMD, qid in 31..255 -> OOB `txd` at a
predictable offset (255-31)*sizeof(iwm_tx_ring) past `sc->txq` -> NULL/1
writes at chosen ring granularity + wild node pointer deref -> kernel memory
corruption/panic; with heap grooming of the softc-adjacent allocation this
is a write primitive. Not demonstrable further without the device.

## Precedent
DF-1122 (iwn `iwn_rx_compressed_ba`, identical missing qid bound, severity
High). FreeBSD's later if_iwm grew the same class of checks.

## Fix validation
fix.diff authored (bounds check + drop). In-kernel validation impossible on
this guest (no device to generate TX completions) → fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.