{
  "finding_id": "DF-3726",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ixgbe_set_ethertype_anti_spoofing_X550 and ixgbe_restore_mdd_vf_X550 consume their vf index with no range validation (ixgbe_x550.c:1078, :1429-1436): vf >= 64 (PFVFSPOOF, 8 regs) or vf beyond the MRQC pool count (WQBR, 4 regs) would index outside the register windows \u2014 OOB MMIO RMW. Latent: if_ix.c never dispatches these ops (no SR-IOV wiring) and the sibling pruning op does bound its index (:1052-1054), proving intent. Upstream-identical (FreeBSD head). mdd_events 2-word vf_bitmap contract (:1489-1490) is undocumented.",
  "exploit_chain": "",
  "evidence": "VERDICT.md path:line trace; fix compile-validated DF-3726_make_rc=0 in ../DF-3724/fix_build.log; ../DF-3723/env.txt (no X550 on guest)",
  "kernel_refs": [
    "sys/dev/netif/ix/ixgbe_x550.c:1078",
    "sys/dev/netif/ix/ixgbe_x550.c:1429",
    "sys/dev/netif/ix/ixgbe_x550.c:1052",
    "sys/dev/netif/ix/ixgbe_type.h:534"
  ],
  "poc_changes": "n/a (source-level)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC)",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Latent hardening; pair with a documented bitmap contract for ixgbe_mdd_event.",
  "recommended_fix": "Bound vf (>= IXGBE_PFVFSPOOF_REG_COUNT*8 reject; >= 64 reject in restore_mdd_vf) \u2014 fix.diff",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to guest /usr/src; module rebuild clean under -Werror (DF-3726_make_rc=0); reverted. Runtime validation impossible (no X550 hardware, no caller).",
  "fix_evidence": "../DF-3724/fix_build.log: DF-3726_make_rc=0 + md5 restored"
}