{
  "finding_id": "DF-3680",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain, runtime-inconclusive: igb_txeof() and igb_txgc() terminate their cleanup loops on an unvalidated NIC-controlled index (32-bit TX-head write-back *(txr->tx_hdr) or TDH register read). An out-of-range value spins the ISR loop forever while holding tx_serialize \u2014 KKASSERT panic on INVARIANTS builds at if_igb.c:2189 after one ring wrap, permanent interrupt-context hang on production builds. Guest has no igb hardware (vtnet0 only; driver compiled into kernel), so the path cannot be exercised; same defect as DF-3668 (ix).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3680/VERDICT.md (loop at if_igb.c:2186/:2239; unvalidated feed at :3361,:3454,:3516,:4737,:4938); run.log (no igb device on guest); fix.diff (range checks in both loops)",
  "kernel_refs": [
    "sys/dev/netif/igb/if_igb.c:2174",
    "sys/dev/netif/igb/if_igb.c:2186",
    "sys/dev/netif/igb/if_igb.c:2189",
    "sys/dev/netif/igb/if_igb.c:2220",
    "sys/dev/netif/igb/if_igb.c:2230",
    "sys/dev/netif/igb/if_igb.c:2239",
    "sys/dev/netif/igb/if_igb.c:3454",
    "sys/dev/netif/igb/if_igb.c:4737",
    "sys/dev/netif/igb/if_igb.c:4938",
    "sys/dev/netif/igb/if_igb.h:250"
  ],
  "poc_changes": "No runnable PoC without igb hardware; trigger.c documents the on-hardware write-back corruption procedure and sink lines; run.sh performs the module-presence/device-absence probe.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh (no-op: device-side trigger)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root kldstat | grep -i igb; ifconfig -a | grep -c ^igb; ls -l /boot/kernel/if_igb.ko",
  "code_hash": "",
  "notes": "Driver compiled into guest kernel; zero igb interfaces. DoS-class impact contingent on a misbehaving device (fault/erratum/malicious PCIe/VF).",
  "recommended_fix": "Range-check hdr against num_tx_desc in igb_txeof() and igb_txgc() before the cleanup loops and bail out on out-of-range values.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree; cannot be validated without igb hardware.",
  "fix_evidence": "findings/poc/DF-3680/fix.diff"
}