{
  "finding_id": "DF-4079",
  "title": "oce_rx builds mbuf chain with m_pkthdr.len from the CQE 14-bit pkt_size unclamped to num_fragments x frag_size: chain up to 2047 bytes shorter than claimed, handed to if_input — stack offset-walkers (m_copydata KASSERT) panic, TCP desynchronizes",
  "verdict": "reproduced",
  "impact": "panic (mbuf contract violation: chain up to 2047 bytes shorter than pkthdr.len; demonstrated kernel panic via the cited m_copydata consumer; TCP-desync primitive)",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh   (make -m /usr/src/share/mk; KLD only, no driver code — extern-binds the running kernel's own oce_rq_handler)",
    "run": "sh run.sh baseline   (survives, prints both CHAIN INVARIANT VIOLATION markers); fresh boot + sh run.sh panic   (kernel panic)",
    "expected": "baseline: two chains delivered claiming 16383 bytes holding 2048/14336 bytes; panic: 'panic: m_copydata: offset > size of mbuf chain' with oce_rx in the backtrace; fixed kernel: FIX CONFIRMED (chains=0 violations=0) and panic mode survives"
  },
  "kernel_refs": [
    "sys/dev/netif/oce/oce_if.c:1260",
    "sys/dev/netif/oce/oce_if.c:1274",
    "sys/dev/netif/oce/oce_if.c:1290",
    "sys/dev/netif/oce/oce_if.c:1291",
    "sys/dev/netif/oce/oce_if.c:1299",
    "sys/dev/netif/oce/oce_if.c:1373",
    "sys/dev/netif/oce/oce_if.c:1381",
    "sys/dev/netif/oce/oce_hw.h:2531",
    "sys/dev/netif/oce/oce_hw.h:2549",
    "sys/kern/uipc_mbuf.c:1679"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df4079_oce_poc.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "panic.txt",
    "panic_console_full.log", "fix.diff", "fix_build.log", "fix_run.log",
    "env.txt", "manifest.json", "verdict.json"
  ]
}