{
  "finding_id": "DF-3723",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain OOB read in the exported caller-buffer path of ixgbe_calc_checksum_X550/ixgbe_checksum_ptr_x550: the guard at ixgbe_x550.c:3376 checks start+length against buffer_size but reads occur at buffer[ptr+i] (:3360,:3394), and :3358/:3430 are off-by-one \u2014 proven by an on-guest replica of the exact guards/loop (run.log: shipped code reads buffer[91..140] of a 100-word buffer; fixed guards reject). Runtime inconclusive only because the guest has no X550 NIC (env.txt: pciconf shows no Intel 10G device) and no in-tree caller passes a non-NULL buffer \u2014 latent, same defect present in Linux master and FreeBSD head. The live NULL-buffer path used at attach (if_ix.c:615) is bounded by word_size checks (:3454,:3371) and is safe.",
  "exploit_chain": "",
  "evidence": "run.log (SHIPPED: OOB READ first OOB index=100; OFF-BY-ONE accepted vs FIXED rejected), fix_build.log (if_ix.ko rebuild with fix.diff clean under -Werror), env.txt (no X550 hardware on guest)",
  "kernel_refs": [
    "sys/dev/netif/ix/ixgbe_x550.c:3358",
    "sys/dev/netif/ix/ixgbe_x550.c:3376",
    "sys/dev/netif/ix/ixgbe_x550.c:3394",
    "sys/dev/netif/ix/ixgbe_x550.c:3430",
    "sys/dev/netif/if_ix.c:615"
  ],
  "poc_changes": "wrote bound-math harness replicating the exact shipped guards + loop (no hardware needed); fix.diff authored and compile-validated on guest /usr/src",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC)",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/chksum_bounds_demo /tmp/chksum_bounds_demo.c (guest, DragonFly cc 8.3)",
  "run_cmd": "/tmp/chksum_bounds_demo (guest)",
  "code_hash": "bbaec734bfd8e02e0a19c92d6bd4cbcf8327bb1b17bac7aa50b9f3e3a9d714eb",
  "notes": "Upstream-identical defect (Linux master + FreeBSD head verified 2026-09-15) \u2014 candidate for upstream report. Latent: dead code in kernel as built (only NULL-buffer caller at ixgbe_x550.c:3490).",
  "recommended_fix": "Include the ptr base offset in the bounds check ((u32)ptr+(u32)start+(u32)length > buffer_size), make :3358 use <=, and require buffer_size >= IXGBE_EEPROM_LAST_WORD+1 at :3430",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to guest /usr/src/sys/dev/netif/ix; full if_ix.ko module rebuild clean with -Werror (fix_build.log, make_rc=0); harness shows fixed guards reject both the ptr-offset and off-by-one cases. Runtime fix validation impossible: no X550 hardware, and the buffer path has no in-tree caller. Patch reverted in guest afterwards (md5 restored).",
  "fix_evidence": "fix_build.log: cc ... -Werror ... -c ixgbe_x550.c + cc -r -o if_ix.ko ... ixgbe_x550.o rc=0; run.log FIXED lines"
}