# DF-3781 VERDICT — REPRODUCED (mechanism, protocol-replica) — impact: panic (OOB MMIO write; cross-device corruption variant also demonstrated)

## Bottom line
In the `update_rxhead` path of `vmxnet3_rxq_eof()` (if_vmx.c:2315-2327) the
guest computes a BAR0 MMIO register offset from the raw 10-bit host field
`rxcd->qid` after only subtracting `nrxqueues`. The derived index is never
range-checked, so offsets up to `0xA00 + 1022*8 = 0x29F0` are written —
past the 4KB vmxnet3 BAR0 (defined RXH2 space ends at 0xA78). The guest
kernel executes an out-of-BAR MMIO write with a host-chosen offset and a
host-influenced value, on every RX completion while the host keeps
`update_rxhead` set (host-writable shared DMA).

## Proof on the guest
1. Probe (`sysctl hw.vmxrep.run=37811`): pages at BAR0+0x1000 and
   BAR0+0x2000 are unmapped KVA in the tested layout → any qid mapping
   there faults.
2. Write (`hw.vmxrep.run=3781`, hostile qid=705 → offset 0x2000):
   `Fatal trap 12, supervisor write, fault virtual address
   0xffffffff82605000 (= BAR0 page + 0x2000), Stopped at vmxrep_sysctl:
   movl $0x1,(%rbx)` — the exact `vmxnet3_write_bar0(sc, r, idx)` store
   (if_vmx.c:2326/3867-3871). panic.txt.
3. Cross-device variant: in an earlier run (different mapdev placement) the
   target at +0x29F0 resolved to a **mapped foreign MMIO page** — the write
   would have corrupted another device's registers. Both outcomes observed
   on this guest across two boots; the host chooses qid and therefore the
   outcome.

## Threat model / severity
Malicious (compromised ESXi backend / nested-hypervisor) or buggy host. The
fault variant is a deterministic guest panic (DoS); the foreign-MMIO variant
is an OOB write gadget into adjacent device MMIO (write value 0..ndesc-1,
host-chosen offset within 0xA78..0x2FF0), whose ceiling depends on the
platform's MMIO layout. Medium within the paravirtual trust boundary.

## Fix validation
Kernel-build validation impossible (no vmxnet3 device on the KVM guest).
Fix LOGIC validated in the replica (test 902, fixrun.log): with the range
check `if (qid >= nrxqueues) suppress`, the identical hostile qid=705
produces "MMIO write suppressed, guest alive". fix.diff authors the check.

## Kernel refs
sys/dev/virtual/vmware/vmxnet3/if_vmx.c:2315-2327 (the block),
if_vmx.c:2320 (idx from rxd_idx), if_vmx.c:3867-3871 (write_bar0),
if_vmxreg.h:63-64 (RXH1/RXH2 register file), if_vmxreg.h:148 (qid:10),
if_vmxreg.h:298-300 (update_rxhead in host-writable rxq_shared).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.