# DF-3633 VERDICT

**Status: inconclusive (kernel path not exercisable — no iwm hardware on
guest). Confidence in the defect: certain (source-level loop arithmetic).**

## Verified in source

1. `hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff;`
   (`sys/dev/netif/iwm/if_iwm.c:5710`) — 12-bit mask, values 0..4095.
   `struct iwm_rb_status` documents the field as "[0:11]"
   (`sys/dev/netif/iwm/if_iwmreg.h`, iwl-fh.h comment block) — the hardware
   register is 12 bits wide while the driver ring is
   `IWM_RX_LEGACY_RING_COUNT == 256` or `IWM_RX_MQ_RING_COUNT == 512`
   (`sys/dev/netif/iwm/if_iwmvar.h:287-288`).
2. The consumption loop `while (sc->rxq.cur != hw)`
   (`if_iwm.c:5715-5727`) advances `ring->cur = (ring->cur + 1) % count`
   — cur is confined to `[0, count)`. For any `hw` in `[count, 4096)` the
   loop predicate can never be satisfied → infinite loop inside the
   interrupt handler while holding `sc->sc_lk` (`iwm_intr` `:5754`) with
   `IWM_CSR_INT_MASK` cleared (`:5755`). System-wide hard hang, no panic.
3. Loop termination therefore silently depends on the *device* never
   writing a value ≥ ring size — device DMA is untrusted input.

Precedent: DF-3581 (iwn `iwn_notif_intr`, 12-bit closed_count vs 64-slot
ring, Low/CWE-835) — identical pattern, iwm twin.

## Why not reproduced on the guest
No iwm PCI device exists (env.txt): `iwm_notif_intr` is only reachable from
the device interrupt, which never fires.

## Impact ceiling
Hard hang / denial of service of the entire machine (interrupt-context
infinite loop under the driver lock). No memory corruption. Requires
errant/malicious device DMA — Low severity, consistent with DF-3581.

## Fix validation
fix.diff authored (mask `hw` to ring size). In-kernel validation impossible
(no device) → fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.