{
  "finding_id": "DF-4066",
  "title": "ti_rxeof uses the NIC-DMA'd uint16_t return-descriptor ti_idx with no bounds check to index ti_rx_{std,jumbo,mini}_chain[] (512/256/1024): OOB pointer read used as mbuf (wild-pointer stores + if_input type confusion) and OOB 8-byte NULL write up to +512KB past the chain arrays inside struct ti_softc",
  "verdict": "inconclusive",
  "impact": "none_observed_hw_gated__source_oob_write_and_wild_mbuf_deref",
  "reproduce": {
    "build": "cc -O2 -Wall -Wextra -o /tmp/df4066 /tmp/df4066.c",
    "run": "/tmp/df4066 (geometry model; on real hw: faulty/malicious Tigon descriptor index)",
    "expected": "model prints per-path OOB landing table (RC_DF4066_MODEL=0); on hardware: NULL-deref panic / softc corruption"
  },
  "kernel_refs": [
    "sys/dev/netif/ti/if_ti.c:1638",
    "sys/dev/netif/ti/if_ti.c:1648",
    "sys/dev/netif/ti/if_ti.c:1649",
    "sys/dev/netif/ti/if_ti.c:1662",
    "sys/dev/netif/ti/if_ti.c:1663",
    "sys/dev/netif/ti/if_ti.c:1676",
    "sys/dev/netif/ti/if_ti.c:1677",
    "sys/dev/netif/ti/if_ti.c:1690",
    "sys/dev/netif/ti/if_ti.c:1706",
    "sys/dev/netif/ti/if_tireg.h:711",
    "sys/dev/netif/ti/if_tireg.h:1100"
  ],
  "artifacts": ["README.md", "VERDICT.md", "trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "fix_build.log", "manifest.json", "verdict.json"]
}