# DF-3726 — VERDICT

**Status: inconclusive at runtime (no X550 hardware; no in-tree caller). Source-certain missing input validation on exported HAL ops.**

## Root cause

Three X550 mac-ops consume a VF/pool index with no range validation:

1. ixgbe_x550.c:1078 — `int vf_target_reg = vf >> 3;` … :1084/:1090
   `IXGBE_READ_REG/WRITE_REG(hw, IXGBE_PFVFSPOOF(vf_target_reg), …)`.
   `IXGBE_PFVFSPOOF(_i)` (ixgbe_type.h:534) is `0x08200 + 4*i` with exactly 8
   registers (IXGBE_PFVFSPOOF_REG_COUNT, ixgbe_type.h:557). `vf >= 64` (or
   negative) indexes outside the block → OOB **MMIO** read-modify-write.
2. ixgbe_x550.c:1429-1436 — `start_q = vf * num_qs` (num_qs from the live
   MRQC mode, 2/4/8), `idx = start_q / 32`, then
   `IXGBE_WRITE_REG(hw, IXGBE_WQBR_TX(idx) / IXGBE_WQBR_RX(idx), reg)`.
   WQBR windows are 4 registers (ixgbe_type.h:472-473) covering 128 queues;
   `vf` beyond the mode's pool count walks out of the window.
3. ixgbe_x550.c:1489-1490 — `idx = vf / 32; vf_bitmap[idx] |= …` with vf ≤ 63
   by construction (q ≤ 127 from 4×32 WQBR bits, shift ≥ 1) → requires a
   ≥ 2-word bitmap; contract undocumented in ixgbe_api.c:1289.

The pruning sibling bounds its index (`pool > 63`, :1052-1054) — the two
missing checks are an oversight, not a design choice.

## Why Info

- No in-tree caller: `rg` over if_ix.c shows the driver never dispatches
  these ops (they belong to SR-IOV/VF-management paths this driver does not
  implement); ixgbe_api.c wrappers (:1223, :1289, :1302) are the only
  (unused) entry points. Compiled-in, never executed — latent.
- When eventually wired, callers are kernel-internal VF loops; the index
  would have to come from a future ioctl/sysctl to be attacker-influenced.
- Upstream-identical (FreeBSD head `ixgbe_restore_mdd_vf_X550` has no bound
  either).

## Verification

- Guest has no X550 NIC (../DF-3723/env.txt) — cannot execute.
- `fix.diff` (vf bounds in both functions) compile-validated on guest
  `/usr/src` with `-Werror` (`DF-3726_make_rc=0`, ../DF-3724/fix_build.log),
  reverted after (md5 restored).

## Recommended fix

`fix.diff`: reject `vf < 0 || vf >= IXGBE_PFVFSPOOF_REG_COUNT * 8` in the
anti-spoof op and `vf >= 64` in restore_mdd_vf; document the 2-word bitmap
contract for mdd_event.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.