DF-4066 model: ti_rxeof OOB via NIC-DMA'd uint16_t ti_idx (if_ti.c:1638,1648-77)
chain arrays (if_tireg.h:1099-1102): std=512 jumbo=256 mini=1024; idx field u16 (if_tireg.h:707/711)

STD path (array ti_rx_std_chain[512], if_ti.c:1676-1677):
  std   rxidx=511    -> element offset +   4088 (max in-bounds +4088)   in-bounds
  std   rxidx=512    -> element offset +   4096 (max in-bounds +4088)   OOB by 1 elements
      8-byte NULL write lands inside ti_rx_jumbo_chain[256] (+0 within that region)
  std   rxidx=513    -> element offset +   4104 (max in-bounds +4088)   OOB by 2 elements
      8-byte NULL write lands inside ti_rx_jumbo_chain[256] (+8 within that region)
  std   rxidx=640    -> element offset +   5120 (max in-bounds +4088)   OOB by 129 elements
      8-byte NULL write lands inside ti_rx_jumbo_chain[256] (+1024 within that region)
  std   rxidx=1023   -> element offset +   8184 (max in-bounds +4088)   OOB by 512 elements
      8-byte NULL write lands inside ti_rx_mini_chain[1024] (+2040 within that region)
  std   rxidx=2047   -> element offset +  16376 (max in-bounds +4088)   OOB by 1536 elements
      8-byte NULL write lands inside ti_jslots[384] (32B ea; ti_sc/ti_buf/ti_inuse/ti_slot) (+2040 within that region)
  std   rxidx=4095   -> element offset +  32760 (max in-bounds +4088)   OOB by 3584 elements
      8-byte NULL write lands 6128 bytes past struct ti_chain_data (further softc fields / adjacent kernel heap)
  std   rxidx=65535  -> element offset + 524280 (max in-bounds +4088)   OOB by 65024 elements
      8-byte NULL write lands 497648 bytes past struct ti_chain_data (further softc fields / adjacent kernel heap)

JUMBO path (array ti_rx_jumbo_chain[256], if_ti.c:1648-1649):
  jumbo rxidx=255    -> element offset +   2040 (max in-bounds +2040)   in-bounds
  jumbo rxidx=256    -> element offset +   2048 (max in-bounds +2040)   OOB by 1 elements
      8-byte NULL write lands inside ti_rx_mini_chain[1024] (+0 within that region)
  jumbo rxidx=257    -> element offset +   2056 (max in-bounds +2040)   OOB by 2 elements
      8-byte NULL write lands inside ti_rx_mini_chain[1024] (+8 within that region)
  jumbo rxidx=511    -> element offset +   4088 (max in-bounds +2040)   OOB by 256 elements
      8-byte NULL write lands inside ti_rx_mini_chain[1024] (+2040 within that region)
  jumbo rxidx=1024   -> element offset +   8192 (max in-bounds +2040)   OOB by 769 elements
      8-byte NULL write lands inside ti_rx_mini_chain[1024] (+6144 within that region)
  jumbo rxidx=65535  -> element offset + 524280 (max in-bounds +2040)   OOB by 65280 elements
      8-byte NULL write lands 501744 bytes past struct ti_chain_data (further softc fields / adjacent kernel heap)

MINI path (array ti_rx_mini_chain[1024], if_ti.c:1662-1663):
  mini  rxidx=1023   -> element offset +   8184 (max in-bounds +8184)   in-bounds
  mini  rxidx=1024   -> element offset +   8192 (max in-bounds +8184)   OOB by 1 elements
      8-byte NULL write lands inside ti_jslots[384] (32B ea; ti_sc/ti_buf/ti_inuse/ti_slot) (+0 within that region)
  mini  rxidx=2048   -> element offset +  16384 (max in-bounds +8184)   OOB by 1025 elements
      8-byte NULL write lands inside ti_jslots[384] (32B ea; ti_sc/ti_buf/ti_inuse/ti_slot) (+8192 within that region)
  mini  rxidx=65535  -> element offset + 524280 (max in-bounds +8184)   OOB by 64512 elements
      8-byte NULL write lands 503792 bytes past struct ti_chain_data (further softc fields / adjacent kernel heap)

Primitives per out-of-range rxidx:
  READ : m = chain[rxidx]           (if_ti.c:1648/1662/1676)
  WRITE: chain[rxidx] = NULL        (if_ti.c:1649/1663/1677) -> 8 zero bytes at base+8*rxidx, rxidx<=65535 -> up to +511 KB
  WRITE: m->m_pkthdr.len = m->m_len = cur_rx->ti_len (if_ti.c:1690) -> two stores through the OOB-read pointer,
         m_len at fixed offset +8 of the wild 'mbuf', value = NIC-chosen 16-bit ti_len
  USE  : ifp->if_input(ifp, m, NULL, -1) (if_ti.c:1706) -> wild-mbuf type confusion into ether_input

RC_DF4066_MODEL=0
RC=0