# DF-3667 — ix(4) ix_rxeof trusts NIC-DMA'd descriptor length: unbounded m_len → heap OOB read

**File:** `sys/dev/netif/ix/if_ix.c` · **Severity:** Medium · **Class:** RX-descriptor length trust (DF-3604/DF-3639/DF-3663 family)

## Build / Run (bound-math demonstration harness)

```
cc -O2 -Wall -o df3667_sim df3667_sim.c
./df3667_sim
```

The harness is a **userspace simulation** (clearly labeled in source) replicating
the exact assignment chain of `ix_rxeof()` with the real cluster sizes. It is
evidence for the bound arithmetic, NOT a kernel reproduction — the guest has no
ixgbe NIC, so the kernel path cannot run there.

## Expected output

```
DF-3667 ix_rxeof descriptor-length trust — bound math
cluster(MCLBYTES)=2048      desc len=0xffff  claimed m_len=65535  OOB read span=63487 bytes
cluster(MJUMPAGESIZE)=4096  desc len=0xffff  claimed m_len=65535  OOB read span=61439 bytes
redzone bytes a consumer would hand to the stack (2K cluster): 63487
m_pkthdr.len accumulator (single desc): 65535  (chain adds per desc, if_ix.c:3044)
modest lie 3000 -> 2048 cluster: OOB span=952
```

## Fix validation (compile-level)

`fix.diff` was applied to the guest's `/usr/src` (byte-identical to the audit
tree, md5-verified) and the driver built as a module with `-Werror`:

```
cd /usr/src/sys/dev/netif/ix && make obj && make     # baseline: build_baseline.log
patch -p1 < fix.diff (from /usr/src)                 # patched: build_patched.log
cd /usr/src/sys/dev/netif/ix && make clean && make   # -> if_ix.ko, 0 errors/0 warnings
```

Runtime behavioral validation is impossible on this guest (no 10GbE hardware).

## Guest state

`env.txt` — ix(4) compiled into the running X86_64_GENERIC kernel (config line
217), no Intel 82598/X540/X550 PCI device present, `dev.ix.*` sysctl count 0.
Verdict: **inconclusive (hardware absent)**, source-level certain.