# DF-3938 — VERDICT

**Status: inconclusive (dead code + hardware-gated) — defect certain at
source; latent OOB read/write. Info severity.**

## Source proof

- `sys/dev/virtual/amazon/ena/ena-com/ena_admin_defs.h:593-599`:
  `struct ena_admin_feature_rss_flow_hash_control { uint32_t keys_num;
  uint32_t reserved; uint32_t key[10]; }` — `keys_num` is a **u32 inside the
  device-DMA'd control buffer**.
- `ena_com.c:2342-2345` — `ena_com_get_feature_ex(..., rss->hash_key_dma_addr,
  sizeof(*rss->hash_key))`: the device writes the whole 48-byte struct
  (keys_num included) by DMA.
- `ena_com.c:2354` — `memcpy(key, hash_key->key, (size_t)(hash_key->keys_num)
  << 2);` — length device-chosen, up to 0x3FFFFFFFC bytes; source region is
  40 bytes inside a 48-byte coherent alloc; destination size unknown to this
  function. Both directions unbounded.
- Contrast with the bounded write side: `ena_com.c:2305-2313`
  (`key_len > sizeof(hash_key->key)` check before
  `memcpy(hash_key->key, key, key_len)`).

## Reachability (killed honestly)

- Whole-tree grep for callers: `ena_com_get_hash_function` appears only at
  its definition (`ena_com.c:2332`), its header prototype
  (`ena_com.h:715`), and one internal call with `key == NULL`
  (`ena_com.c:2327`, error-restore inside `ena_com_fill_hash_function`).
  `ena.c` / `ena_sysctl.c` never call it. So the OOB cannot execute in this
  tree today — hence Info/latent, not Medium.
- Even with hardware present, the guest has no ENA device (env.txt).

Classification: Info, confidence certain (that the code is wrong), latent —
the DF-3799 precedent (dead-code defect documented for the port's future).

## Fix

`fix.diff`: clamp to `sizeof(hash_key->key)` using ENA_MIN32 (already
defined in `ena_plat.h`).

## fix_status

`not_testable` — dead code + no hardware.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.