⬢ DragonFlyBSD Kernel Audit
DF-3667 / run.log
← back to finding ↓ download raw
DF-3667 ix_rxeof descriptor-length trust — bound math
cluster(MCLBYTES)=2048      desc len=0xffff  claimed m_len=65535  OOB read span=63487 bytes
cluster(MJUMPAGESIZE)=4096  desc len=0xffff  claimed m_len=65535  OOB read span=61439 bytes
redzone bytes a consumer would hand to the stack (2K cluster): 63487
m_pkthdr.len accumulator (single desc): 65535  (chain adds per desc, if_ix.c:3044)
modest lie 3000 -> 2048 cluster: OOB span=952