# DF-3719 VERDICT

**Status: inconclusive** (hardware-gated; attach-time path needs a Myricom
NIC), **confidence: certain** source-level.

## Source proof
1. fw_len comes from fw registration metadata, not the stream: :685
   `fw_len = (size_t)fw->version;` (FIRMWS third field, fw/*/Makefile).
2. Copy loop :713-719 writes fw_len bytes at sc->sram + MXGE_FW_OFFSET
   with no comparison to sc->sram_size even though the caller seeded
   *limit = sc->sram_size (:910-911); :721 overwrites *limit with fw_len.
3. Short-inflate: only `status != Z_STREAM_END` is rejected (:692); a
   stream that ends early leaves inflate_buffer's tail uninitialized and
   still copied for fw_len bytes.
4. version==NULL edge → kmalloc(0) + 4-byte read at +0x3c before any
   bounds check (:700).

Zlib-stream validation and the header walk are correct — this finding is
strictly the missing fw_len↔SRAM and fw_len↔total_out relationships.

## Not reproduced
Attach path requires the device (firmware_get runs from mxge_select_firmware
at attach :4341). Guest: no 0x14c1 device (env.txt).

## Fix
fix.diff: fw_len = min(fw_len, zs.total_out) + reject fw_len+MXGE_FW_OFFSET
> *limit. git apply --check clean; not buildable without hardware.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.