# DF-3713 — em_rxeof trusts the 16-bit NIC descriptor length with no posted-buffer bound

**File:** `sys/dev/netif/em/if_em.c`
**Lines:** 3692 (`desc_len = le16toh(current_desc->length)`), 3694-3706 (len math), 3715 (error-path probe), 3738 (`mp->m_len = len`), 3761 (`fmp->m_pkthdr.len += len`)
**Family:** DF-3604 (bce), DF-3639 (bnx), DF-3663 (bge), DF-3667 (ix), DF-3679 (igb) — this is the em(4) member of the unbounded-RX-length family. The known em finding DF-1188 covers only `desc_len == 0` on an error descriptor (negative-direction probe); this finding is the positive direction (`desc_len > posted buffer`).

## Reproduce on a box with real em(4) hardware

Device-side trigger (requires a faulty/malicious NIC DMA source — descriptor
corruption, erratum, SR-IOV/emulation fault):

```
# Post RX buffers (interface up), then DMA-write a legacy RX descriptor
# write-back with length = 0xFFFF and DD|!EOP set:
#   desc->length = 0xFFFF; desc->status = E1000_RXD_STAT_DD;
# -> em_rxeof computes len = 65535, assigns mp->m_len = 65535 on a
#    2048-byte cluster; ether_input/BPF/forwarding walk ~63.5KB of
#    adjacent kernel heap.
```

## On this audit guest

No em hardware. `run.sh` performs the presence probe; `run.harness.log`
(guest-executed userspace replica of the exact arithmetic, `build.sh`)
demonstrates: desc_len=0xFFFF (non-EOP) → m_len claims 63487 bytes past the
cluster; desc_len=0xFFFF (EOP) → 63483 bytes past; error-path probe at
`:3715` reads at `mp->m_data + 65534`; prev_len_adj underflow (previous
fragment m_len 0, EOP desc_len 2) → `lmp->m_len = -2` (negative m_len
injected into the RX chain).

```
sh build.sh && ./run.sh
```