{
  "finding_id": "DF-3756",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain OOB write: tulip_srom_decode() advances the media-info pointer mi once per well-formed SROM block with no bound against tulip_softc.tulip_mediainfo[10] (if_devar.h:483); blocks is a raw EEPROM byte (if_de.c:2183), so >=11 blocks write past the array into the softc tail (tulip_setup_tag/map/dma_addr/setupbuf pointer, tulip_setupdata[48], tulip_boardid[24]) and further into the kernel heap. A 1:1 userspace logic model built and run on the audit guest confirmed 13 OOB writes reaching +364 bytes and clobbering the tulip_setupbuf kernel pointer. The kernel path itself executes only at device attach on a physical DEC 2114x card with a crafted EEPROM; the guest has the driver compiled in but zero DEC hardware (hw.de.* count=0, no 0x1011 PCI devices), and QEMUs tulip model has a hardcoded valid SROM, so kernel-path reproduction is impossible on this rig -> inconclusive. Decode gate: valid SROM CRC (attacker-computable) or, on 21142/21143, NO CRC CHECK AT ALL (if_de.c:2498-2500). Distinct from DF-1205 (OOB reads past tulip_rombuf): different array, write primitive.",
  "exploit_chain": "Crafted EEPROM on 21142/21143 (no CRC gate) or CRC-valid crafted SROM -> tulip_pci_attach -> tulip_read_macaddr (if_de.c:4278) -> tulip_srom_decode -> 13+ mi writes past tulip_mediainfo[10] -> clobber tulip_setupbuf pointer with SROM-controlled 32-bit pairs -> next multicast filter update bcopy()s 192 bytes through the forged pointer (if_de.c:3637) -> arbitrary kernel write; OOB tulip_mediums[] pointers additionally dereferenced at runtime by tulip_media_set (if_de.c:247). Requires attacker-supplied/reprogrammed PCI hardware.",
  "evidence": "run.log: OOB writes performed: 13 + tulip_setupbuf CLOBBERED (0x00000001a4a4a4a4); VERDICT.md root-cause walk with all mi++ sites; env.txt: kldstat pci/if_de present, sysctl hw.de.* count=0, no DEC PCI devices.",
  "kernel_refs": [
    "sys/dev/netif/de/if_devar.h:483",
    "sys/dev/netif/de/if_de.c:2080",
    "sys/dev/netif/de/if_de.c:2183",
    "sys/dev/netif/de/if_de.c:2223",
    "sys/dev/netif/de/if_de.c:2498-2500",
    "sys/dev/netif/de/if_de.c:3637",
    "sys/dev/netif/de/if_de.c:4278"
  ],
  "poc_changes": "No seed PoC existed; authored from scratch. One iteration: first build failed on a mimic field name (gpr_gpdata vs models anonymous struct), fixed and rebuilt clean.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o srom_mediainfo_model srom_mediainfo_model.c",
  "run_cmd": "./srom_mediainfo_model; echo exit=$?",
  "code_hash": "01382cf126799087362f03bebb7e851af329b979bfdc17981d06eed3b66c8dba",
  "notes": "Guest work limited to module-presence check + userspace logic model, per orchestrator instruction (no DEC tulip hardware). Severity Low due to hardware/EEPROM precondition (DF-1205 precedent); memory-safety defect itself is certain.",
  "recommended_fix": "Bound mi against tulip_mediainfo[NELEM] at the top of both SROM block loops in tulip_srom_decode (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (mi bound guard in both block loops); not kernel-tested: no DEC 2114x hardware on the guest, and a patched-kernel build cannot attach the driver either.",
  "fix_evidence": "Same hardware absence as baseline: env.txt (hw.de.* count=0). Logic models guard check pattern mirrors the proposed bound."
}