# DF-3630 VERDICT

**Status: inconclusive (kernel path not exercisable — no iwm hardware on
guest). Confidence in the defect: certain (source-level arithmetic).**

## Verified in source

1. `sc_cmd_resp` is `uint8_t[IWM_CMD_RESP_MAX]`, `IWM_CMD_RESP_MAX ==
   PAGE_SIZE` = 4096 (`sys/dev/netif/iwm/if_iwmvar.h:312,500`).
2. RX buffers are 4096-byte clusters: `iwm_rx_addbuf()` allocates
   `m_getjcl(M_WAITOK, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE)`
   (`sys/dev/netif/iwm/if_iwm.c:3053`), `IWM_RBUF_SIZE == 4096`
   (`if_iwmvar.h:290`).
3. `iwm_handle_rxb()` walks multiple firmware packets per buffer starting at
   arbitrary `offset` bounded only by `HAVEROOM(offset)` = offset+8 < 4096
   (`if_iwm.c:5372-5405`), i.e. offset ≤ 4087.
4. On `IWM_NVM_ACCESS_CMD`/`IWM_MCC_UPDATE_CMD` response match
   (`if_iwm.c:5509-5514`) it copies `sizeof(sc->sc_cmd_resp)` = 4096 bytes
   from `pkt` — a copy span of `[offset, offset+4096)` in a 4096-byte
   cluster → **up to 4087 bytes past the end of the mbuf cluster** whenever
   the response packet does not sit at offset 0. The packet's own length
   (`len = iwm_rx_packet_len(pkt) + 4`, `:5403-5404`) is computed but never
   used to bound this copy.
5. The copied buffer becomes `hcmd->resp_pkt` (`if_iwm_util.c:327`) and is
   parsed by consumers (e.g. `iwm_nvm_read_chunk` `if_iwm.c:1856-1903`).
6. Sibling: `iwm_alive_fn()` v3 fallback (`if_iwm.c:2784-2789`) reads a
   fixed-size struct from the raw notification packet without any payload
   length check (contrast the correct pattern at `:5535` for
   DTS_MEASUREMENT and `:2778` for the v4 size match).

## Why not reproduced on the guest
No Intel Wireless PCI device exists (`pciconf` empty; `kldload if_iwm`
attaches nothing — env.txt). The RX path cannot be driven without the
device. The overread is pure arithmetic: overrun bytes == packet offset
within the cluster.

## Impact ceiling
Kernel heap OOB read (up to ~4KB past a 4KB mbuf cluster) into driver state
consumed for NVM/regulatory parsing; contents can reach logs
(`ether_sprintf(sc->nvm_data->hw_addr)` at `if_iwm.c:6389` prints a MAC
derived from parsed data). Potential crash if the cluster ends at an
unmapped boundary. Requires firmware-controlled RX placement — same trust
boundary as DF-1145 (High).

## Fix validation
fix.diff authored; in-kernel validation impossible (no device) →
fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.