# DF-3849 — dc_rxeof trusts NIC-DMA'd RX frame length (heap OOB read)

**Severity: Medium · confidence: certain (source) · hardware-gated at
runtime (inconclusive per DF-3604 family convention)**

## What this is

`sys/dev/netif/dc/if_dc.c:2523` — `dc_rxeof()` uses the 14-bit FRAMESZ
field from the device-written RX descriptor status as the mbuf length,
with no bound against the 2040-byte posted cluster. A misbehaving or
malicious dc(4) device (21143 + ~15 clone families) can make the kernel
hand the stack an mbuf claiming up to 16379 bytes (14 KB heap over-read,
BPF-visible info leak) or a negative length (≈4 GB unsigned, panic).

## Reproduce (audit guest)

    ./build.sh      # cc -O2 -o /root/trigger /root/trigger.c
    ./run.sh        # hardware-absence probe + exact integer mechanics

Success criterion (observed 2026-09-16):

    FRAMESZ=16383 -> m_len=16379 on a 2040-byte cluster => OOB READ 14339 bytes past the cluster (14.0 KB)
    FRAMESZ=    2 -> m_len=-2 ... NEGATIVE m_len (unsigned ~4294967294): stack OOB walk
    guest: pci/if_dc in kernel; NICs: vtnet0 lo0 only (no dc hardware)

## Files

    trigger.c     arithmetic replica (macros verbatim from if_dcreg.h)
    build.sh / run.sh
    build.log / run.log    full untrimmed guest output
    fix.diff      git-apply-able clamp vs the read-only sys/ tree
    VERDICT.md    full narrative
    verdict.json  machine verdict