{
  "finding_id": "DF-4055",
  "status": "reproduced",
  "reproduced": true,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "REPRODUCED via production-handler KLD dispatch (DF-4106 vge / DF-4266 wb evidence class): the guest kernels OWN et_intr() - which contains et_rxeof() inlined (no separate symbol; verified by disassembly: STATRING shift-16 extract + 0x3ff/0x400 ring bounds inside et_intr) - was dispatched over a fabricated post-attach softc with real busdma rings armed by the kernels own et_newbuf_hdr/et_newbuf_cluster. With the NIC write-back claiming LEN=60000 for a ring-1 buffer backed by one MCLBYTES(2048) cluster, the production handler handed if_input an mbuf with m_len=pkthdr.len=59996 on that 2048-byte cluster 3/3 times (if_et.c:1863/1892/1896/1902; the 16-bit ET_RXST_INFO2_LEN field allows up to 65535, guarded only by buflen < ETHER_CRC_LEN). The sink read kernel-heap bytes past the cluster that differed per run: ASCII text (...ation an\\nd# PasswordAuthenticati), the PREVIOUS slots crafted frame (cross-slot bleed), and pointer soup - the disclosure window production BPF/ether_input gets. Corroboration: freeing the delivered mbuf (what the real stack does) panics the stock kernel - panic: overflowed mbuf, KASSERT M_TRAILINGSPACE>=0 at sys/kern/uipc_mbuf.c:1317, backtrace m_free <- m_freem <- et_intr+0x4bf (panic.txt, first rig run). FIX VALIDATED: kernel #1 rebuilt with fix.diff (per-ring capacity check, drop on violation) - identical rig dropped the over-length claims 3/3 (ierrors=3, oob_events=0, no OOB mbuf, no panic).",
  "exploit_chain": "Device/DMA attacker writes an RX stat ring entry with LEN > buffer capacity: et_rxeof publishes an over-length mbuf to if_input -> BPF taps read up to m_len bytes from a 2048-byte cluster (kernel heap disclosure, repeated per frame) -> the stacks m_freem then trips overflowed mbuf KASSERT panic on stock configs. No userland trigger without the hardware; not pursued to uid0 (read-only primitive, class does not permit).",
  "evidence": "run.log + dmesg_s1.txt (m_len=59996 M_EXT=1 ext_size=2048 3/3, S1 BUG CONFIRMED marker); leak_sample.txt (three differing OOB dumps incl. kernel ASCII text); panic.txt (stock-kernel m_free overflowed mbuf at et_intr+0x4bf); fix_run_s1.log + fix_run_s1_dmesg.txt (patched kernel: dropped 3/3, ierrors=3, no OOB); VERDICT.md; env.txt",
  "kernel_refs": [
    "sys/dev/netif/et/if_et.c:1863",
    "sys/dev/netif/et/if_et.c:1892",
    "sys/dev/netif/et/if_et.c:1896",
    "sys/dev/netif/et/if_et.c:1902",
    "sys/dev/netif/et/if_etvar.h:98",
    "sys/kern/uipc_mbuf.c:1317"
  ],
  "poc_changes": "Authored the production-dispatch rig fresh (no seed PoC existed; pack was untested/hardware-gated). et_rxeof has no symbol of its own - dispatched real et_intr with ET_INTR_STATUS=ET_INTR_RXEOF in the MMIO stand-in instead. Sink v1 freed the delivered mbuf and legitimately panicked the kernel (m_free overflow KASSERT) - kept as panic.txt evidence; v2 bounds the demonstrated read to 32 bytes past the cluster and deliberately leaks the over-length mbuf so the 3-sample run and the sibling scenarios survive on one boot.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64 (baseline) / #1: Wed Oct 14 21:12:27 UTC 2026 (fix-validated)",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root sh /root/dfet/build.sh  (bsd.kmod.mk, -Werror clean KLD)",
  "run_cmd": "vm.sh run_root sh /root/dfet/run.sh 1  (resolves et_* from /boot/kernel/kernel via nm, injects hex sysctls, dispatches real et_intr)",
  "code_hash": "3b4bd9f30b6569fd3e8e1fc571c53fe7953911fdfb17e15a97f78ad8bb12c69c",
  "notes": "Combined rig dfet_poc.c shared with DF-4056/DF-4057 packs (scenarios go=1..4). Attacker model hardware-mediated (faulty/hostile NIC, DMA tampering) - Medium severity stands. Layout cross-check in env.txt. Fix build: make -j6 nativekernel + installkernel, if_et.c recompiled at build-log line 18438, BUILD_OK (fix_build.log trimmed; full log on guest /root/fix_build.log).",
  "recommended_fix": "In et_rxeof, drop (ierrors++) any frame whose device-reported length exceeds the per-ring backing-store size (MHLEN ring0 / MCLBYTES ring1 / ET_JUMBO_FRAMELEN jumbo) before assigning m_len",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel #1 (same tree + fix.diff) A/B with the identical rig: baseline 3/3 over-length mbufs delivered with m_len=59996 on 2048-byte clusters + heap bytes read past the cluster + m_free overflowed mbuf panic on free; patched: delivered=0, oob_events=0, ierrors=3, no panic. Defective behavior gone.",
  "fix_evidence": "findings/poc/DF-4055/fix.diff; fix_run_s1.log; fix_run_s1_dmesg.txt; fix_build.log"
}