{
  "finding_id": "DF-3663",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain: bge_rxeof (sys/dev/netif/bge/if_bge.c:3144) sets m->m_pkthdr.len = m->m_len = cur_rx->bge_len - ETHER_CRC_LEN directly from the NIC-DMAd return-ring descriptor with no bound anywhere on the path \u2014 a faulty or malicious BCM570x/57xx can hand the stack an mbuf describing up to 65531 bytes in a 2046-byte std cluster (m_getcl + m_adj(ETHER_ALIGN), if_bge.c:1024-1030) or a 9016-byte jumbo pool slot (bge HAS jumbo support, unlike the bnx sibling DF-3639; if_bge.c:1087-1114, slots carved from one contiguous BGE_JMEM block at if_bge.c:910-921, so overflow of the last slot runs past the whole DMA allocation). ether_inputs ETHER_BPF_MTAP (sys/net/if_ethersubr.c:1512) then copies the bogus length out of the buffer to bpf listeners => kernel heap OOB read / info disclosure of up to ~63.5KB; bge_len < 18 gives a negative m_len which if_ethersubr.c:1502-1506 drops harmlessly (no underflow panic, unlike bce DF-3604). Additional i386-only WRITE variant (CWE-787): the BGE_FLAG_RX_ALIGNBUG path (BCM5701 PCI-X, if_bge.c:2206-2208) bcopys cur_rx->bge_len bytes into the cluster at if_bge.c:3138-3141 under #if !defined(__x86_64__) \u2014 compiled out of x86_64 kernels. Runtime verification honestly inconclusive: the audit guest has virtio-net only; bge is compiled into the running kernel (kldstat -v: pci/if_bge id 59) but no Broadcom PCI device exists, so bge_attach/bge_rxeof are unreachable (run.log: NO_BROADCOM_DEVICE, ifconfig=vtnet0 lo0, sysctl hw.bge unknown oid). Guest /usr/src if_bge.c md5 f6c2d771384a52775cd4bb399d5dcab1 (plus if_bgereg.h/if_bgevar.h) byte-identical to the audited tree.",
  "exploit_chain": "On real hardware: (1) device DMAs an RX return-ring BD with bge_len=65535 and error flag clear; (2) driver hands the stack an mbuf with m_len=65531 in a 2046B std cluster (or past a 9016B jumbo slot); (3) unprivileged user with a bpf listener on bge0 reads up to ~63.5KB of adjacent kernel heap (info leak); IP-stack parsing of the same OOB range can also fault (panic/DoS); on i386 + BCM5701 PCI-X the ALIGNBUG bcopy turns the same trusted length into a heap OOB write. No write primitive on x86_64 from this bug alone.",
  "evidence": "run.log (guest proof: driver in kernel, zero Broadcom devices, no attach, src md5 match, clean -Wall build), VERDICT.md (full path:line trace incl. the benign underflow path and the i386 write variant), trigger.c (annotated hardware-precondition trigger, builds clean -O -Wall), fix.diff (git apply --check OK; clamp-and-drop bounded by the mbufs own posted length, placed before the i386 bcopy)",
  "kernel_refs": [
    "sys/dev/netif/bge/if_bge.c:3144",
    "sys/dev/netif/bge/if_bge.c:3058",
    "sys/dev/netif/bge/if_bge.c:3138",
    "sys/dev/netif/bge/if_bge.c:1027",
    "sys/dev/netif/bge/if_bge.c:1070",
    "sys/dev/netif/bge/if_bge.c:1103",
    "sys/dev/netif/bge/if_bge.c:1112",
    "sys/dev/netif/bge/if_bge.c:2206",
    "sys/dev/netif/bge/if_bgereg.h:2330",
    "sys/dev/netif/bge/if_bgevar.h:56",
    "sys/net/if_ethersubr.c:1502",
    "sys/net/if_ethersubr.c:1512"
  ],
  "poc_changes": "No seed existed (new pass-2 finding); trigger written as an annotated hardware-precondition skeleton per the DF-3604/DF-3639 precedent, built and executed on the guest to prove the code path is unreachable there.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "cc -O -Wall -o trigger trigger.c (guest)",
  "run_cmd": "./run.sh via dfbsd-qemu/vm.sh run_root (kldstat/pciconf/ifconfig/sysctl hw.bge/md5 of bge sources + trigger)",
  "code_hash": "25edf72062caad08f68c460f6b75068ca8e1e7e7646d80a64741dcf3f1e52617",
  "notes": "Pass-2 calibration: identical NIC-trust-length pattern filed Medium in pass 1 for my(DF-1478), vr(DF-1481), tx(DF-1490), ste(DF-1514), lge(DF-1519), pcn(DF-1562), and Medium for bce DF-3604 / bnx DF-3639; DB-verified that the DF-1478..1562 sweep did NOT cover bge and DF-1159 covers only the bge_idx index bug, so this is not a re-report. bge-specific aggravators vs bnx: jumbo ring extends the bug to 9K slots carved from one DMA block, and the i386 ALIGNBUG path makes it a write.",
  "recommended_fix": "In bge_rxeof, drop the frame (ierrors++ + m_freem) when cur_rx->bge_len is outside [ETHER_HDR_LEN + ETHER_CRC_LEN, m->m_len + ETHER_CRC_LEN] before any use \u2014 including the i386 ALIGNBUG bcopy (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff bounds the NIC-reported length by the mbufs own posted length (correct for both std 2046/2048 and jumbo 9016/9018 configs, ALIGNBUG or not) and is placed before the #if !defined(__x86_64__) block so the OOB-write variant is covered too; git apply --check passes against the pristine tree. Cannot be runtime-validated: the guest has no BCM57xx device so neither baseline nor patched behavior is exercisable (same reason the PoC is inconclusive). The patch mirrors the error-drop idiom already used at if_bge.c:3111-3116.",
  "fix_evidence": "fix.diff (git apply --check OK); baseline absence proof in run.log (NO_BROADCOM_DEVICE, sysctl hw.bge unknown oid)"
}