# DF-3632 VERDICT

**Status: inconclusive (kernel path not exercisable — no iwm hardware on
guest). Confidence in the defect: certain (source-level).**

## Verified in source

1. Section buffers are exact-size heap allocations of the firmware-returned
   length: `temp = kmalloc(len, ...)` at `sys/dev/netif/iwm/if_iwm.c:2367`
   with `len` from `iwm_nvm_read_section()` (bytes the firmware actually
   returned, `:1950-1955`).
2. The only "validation" before parsing is non-NULL pointer checks
   (`if_iwm.c:2290-2333`). `struct iwm_nvm_section.length`
   (`if_iwm.c:247-250`) is recorded and then never consulted again.
3. The parse performs fixed-offset reads listed in README.md; the largest is
   `le16_to_cpup(regulatory + 0x507)` (`if_iwm.c:2251-2255`), which reads
   bytes 0xA0E..0xA0F of the REGULATORY section; the channel-flag memcpys
   read 78/102 bytes at fixed offsets (`:2266-2273`); MAC/SKU/radio reads
   touch fixed words (`:2072-2073, 2125-2158, 2194`). With a short section
   each is a heap OOB read past a small kmalloc.
4. Data sink: `sc->nvm_data` fields → channel map
   (`iwm_init_channel_map` `:2028-2059`), MAC printed via
   `ether_sprintf()` at `:6386-6389`.

Precedent: DF-1898 (phy_db FW lengths unvalidated, Low) and DF-2056 (paging
FW sections unvalidated, Medium) — same driver, same trust boundary; this is
the NVM-sections instance living in if_iwm.c, missed in pass 1.

## Why not reproduced on the guest
No iwm PCI device; `iwm_nvm_init()` runs only from the firmware-bring-up path
(`iwm_run_init_ucode(sc, 1)` → `iwm_preinit`), which requires the device.

## Impact ceiling
Kernel heap OOB reads (tens of bytes to ~2.5KB past exact-size kmallocs) of
attacker(untrusted-FW)-influenced content into driver state and console/log
output (MAC string). Crash potential when adjacent allocations end at page
boundaries. Severity: Low (privileged/physical trust boundary), consistent
with DF-1898.

## Fix validation
fix.diff authored; in-kernel validation impossible (no device) →
fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.