{
  "finding_id": "DF-3938",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated: the buggy line is dead code in this port and requires ENA hardware regardless. fix.diff clamps the memcpy length to sizeof(hash_key->key) via ENA_MIN32 (defined ena_plat.h:196); authored post-verification.",
  "fix_evidence": "findings/poc/DF-3938/fix.diff + VERDICT.md",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ena_com_get_hash_function copies the RSS key to the caller with a fully device-controlled length: memcpy(key, hash_key->key, (size_t)(hash_key->keys_num) << 2) at ena_com.c:2354, where keys_num is a u32 living in the DMA-coherent control buffer the device fills during get_feature (ena_admin_defs.h:593-595, ena_com.c:2291-2345). A malicious ENA device/hypervisor choosing keys_num yields an OOB read past the 48-byte hash_key alloc plus an OOB write of the callers buffer (length up to ~16GiB). Reachability honestly killed: no caller passes a non-NULL key anywhere in the tree (only the internal restore call at ena_com.c:2327 passes NULL; ena.c/ena_sysctl.c never call the function) \u2014 latent, DF-3799-style. Info/hardening; clamp with fix.diff before any future ethtool/sysctl wiring.",
  "exploit_chain": "future caller with fixed-size key buffer (ethtool/sysctl get_rss_key style) + malicious ENA device writing keys_num > 10 -> arbitrary-length kernel memcpy -> OOB read of coherent DMA memory + OOB write into caller buffer",
  "evidence": "findings/poc/DF-3938/VERDICT.md (caller grep) + fix.diff + env.txt",
  "kernel_refs": [
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2354",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2327",
    "sys/dev/virtual/amazon/ena/ena-com/ena_com.c:2305",
    "sys/dev/virtual/amazon/ena/ena-com/ena_admin_defs.h:593"
  ],
  "poc_changes": "No seed PoC; dead code + hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "notes": "pass-2 GLM5.3, hunt area (d) RSS key/hash. The write-side sibling (ena_com_fill_hash_function :2305-2313) is properly bounded; only the read side is unbounded.",
  "recommended_fix": "Clamp the copy length to sizeof(hash_key->key) (fix.diff).",
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null
}