DF-3849 / build.log
BUILD_RC=0 dc_rxeof() length-trust arithmetic (if_dc.c:2523,2568,2583) rxstat=0x05ee0000 FRAMESZ= 1518 -> m_len=1514 on a 2040-byte cluster rxstat=0x05f20000 FRAMESZ= 1522 -> m_len=1518 on a 2040-byte cluster rxstat=0x08000000 FRAMESZ= 2048 -> m_len=2044 on a 2040-byte cluster => OOB READ 4 bytes past the cluster (0.0 KB) rxstat=0x10000000 FRAMESZ= 4096 -> m_len=4092 on a 2040-byte cluster => OOB READ 2052 bytes past the cluster (2.0 KB) rxstat=0x3fff0000 FRAMESZ=16383 -> m_len=16379 on a 2040-byte cluster => OOB READ 14339 bytes past the cluster (14.0 KB) rxstat=0x3fff0300 FRAMESZ=16383 -> m_len=16379 on a 2040-byte cluster => OOB READ 14339 bytes past the cluster (14.0 KB) rxstat=0x00020000 FRAMESZ= 2 -> m_len=-2 on a 2040-byte cluster => NEGATIVE m_len (unsigned ~4294967294): stack OOB walk