{
  "finding_id": "DF-4081",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "oce_tso_setup (oce_if.c:1021-1087) reads ether/IP/TCP header fields — including th->th_off at byte offset up to ~74 — from the first mbuf before the m_pullup at line 1080, with no m_len validation. On TSO frames whose TCP header is not in the first mbuf, th->th_off reads past m_len (stale bytes within the cluster, in-allocation), producing a bogus total_len: m_pullup then fails and the packet is silently dropped. Sibling of pass-1 DF-1373 (oce_check_ipv6_ext_hdr), different function. Untested: no oce NIC in the QEMU guest.",
  "exploit_chain": "",
  "evidence": "README.md, VERDICT.md. Key lines: oce_if.c:1046-1073 (pre-pullup derefs), 1080 (pullup after), 842-852 (call site + drop), 1697-1707 (TSO on by default).",
  "kernel_refs": ["sys/dev/netif/oce/oce_if.c:1046", "sys/dev/netif/oce/oce_if.c:1061", "sys/dev/netif/oce/oce_if.c:1063", "sys/dev/netif/oce/oce_if.c:1071", "sys/dev/netif/oce/oce_if.c:1073", "sys/dev/netif/oce/oce_if.c:1080"],
  "poc_changes": "No runnable PoC: hardware-gated.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Reads stay within the 2048-byte cluster (same containment as DF-1373): correctness/DoS-of-the-packet impact, not disclosure. Filed for completeness of the class fix (both functions should pull up first).",
  "recommended_fix": "m_pullup the ether+IP+TCP header region at the top of oce_tso_setup before any header dereference.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not possible: no OneConnect hardware/emulation in QEMU.",
  "fix_evidence": "Guest pciconf -l: no 0x19a2/0x10df devices."
}