# DF-4045 — stge_rxeof trusts the device-fed 16-bit RxDMAFrameLen (no per-buffer bound)

- **File:** `sys/dev/netif/stge/if_stge.c` (stge(4), Sundance/IC Plus IP1000A, TC9021)
- **Severity:** Medium · **Confidence:** certain · hardware-gated runtime (no stge(4) on the QEMU guest — virtio-net only)
- **Family:** DF-3604 (bce) / DF-3759 (alc) / DF-3933 (age) / DF-3989 (ale) / DF-4024 (re) — device-fed RX length trust

## Build

```sh
cc -O2 -Wall -Wextra -o /root/tr4045 /root/tr4045.c
```

## Run

```sh
/root/tr4045          # userspace geometry model, RC=0
```

## Expected output

The model prints the OOB extents implied by the driver's masks/geometry:

- Case A (jumbo MTU 9004, `SIOCSIFMTU`-legal): a single FrameEnd descriptor
  claiming `framelen = 9022` builds `m_len = 9022` on the 2048-byte cluster
  from `stge_newbuf` → **6974-byte heap OOB read** into a delivered frame
  (readable by any local user with a socket/BPF on `stgeX`).
- Case B (any MTU, incl. default): `framelen < rxlen` at FrameEnd →
  **negative tail `m_len`** → `m_copydata` computes
  `unsigned count = min(m->m_len - off, len)` → ~4 GB `bcopy` → panic/UB
  as soon as any consumer walks the chain (BPF attached); the first mbuf
  is full-sized so `ether_input`'s `m_len < ETHER_HDR_LEN` guard does not
  stop it.

Runtime trigger precondition (NOT met on this guest): a faulty or malicious
TC9021/IP1000A DMA'ing a lying RFD status quadword — see `trigger.c` header.

## Artifacts

`trigger.c`, `build.sh`, `run.sh`, `build.log`, `run.log`, `env.txt`,
`fix.diff`, `VERDICT.md`, `manifest.json`, `verdict.json`.