# DF-4083 VERDICT — sis_rxeof RX-length trust (heap OOB read)

## Status: UNTESTED (hardware-gated, source-level certainty)

The QEMU guest runs neither SiS nor DP83815 hardware: `pciconf -l` shows no
vendor 0x1039 / 0x100b devices, and QEMU has no model for these chips, so the
RX descriptor whose `sis_ctl` length field must be shaped cannot be produced.
Verification on hardware would be: DMA-write one completed RX descriptor with
sis_cmdsts = PKT_OK | 0xFFF, frame bytes carrying IPv4 with ip_len = 4091
(≤ m_pkthdr.len so DFly ip_input length checks pass), then read the delivered
datagram from a bound socket (or BPF) — the tail beyond byte 2048 is adjacent
kernel heap.

## Source trace (why it is real)

1. if_sis.c:1373-1374 — rxstat/total_len taken from `cur_rx->sis_rxstat`
   (= sis_cmdsts, if_sisreg.h:306), the word the NIC DMA-writes on completion.
2. if_sisreg.h:314/324 — length mask is 12 bits (0xFFF), minus ETHER_CRC_LEN.
   Range [-4, 4091]. No relation enforced to SIS_RXLEN (1536, the programmed
   buffer size, if_sisreg.h:472 / if_sis.c:1340) nor to MCLBYTES (2048).
3. if_sis.c:1396 — `m->m_pkthdr.len = m->m_len = total_len;` unconditional on
   the newbuf success path; 1405 delivers to if_input.
4. The mbuf is a 2048-byte cluster (if_sis.c:1296,1302); DMA map loaded for
   the same (1305-1306). Any total_len > 2048 describes more data than the
   buffer holds → consumers read past the cluster (mbuf-cluster zone
   neighbor memory) → disclosure to socket/BPF readers; also feeds
   m_copydata-style walkers (KASSERT 'offset > size of mbuf chain' /
   uipc_mbuf.c:1679 — single-mbuf chain here, so the dominant effect is the
   OOB read, not the panic).
5. Lower edge: BUFLEN < 4 → negative total_len → negative m_len/pkthdr.len →
   dropped by the stack's minimum-length checks (sloppy but benign).

Family precedent: DF-3604 (bce, same trust, 16-bit field, ~63.5 KB past the
cluster) rated Medium/kernleak; this one's ceiling is ~2 KB past the cluster
per packet, repeatable per descriptor.

## Impact ceiling

Kernel heap info leak (limited: 12-bit field ⇒ ≤ 2043 bytes beyond the
cluster per frame) to unprivileged readers of a socket fed by the interface,
or BPF listeners; requires the device (firmware/DMA fault or hostile SR-IOV
peer) to write an oversized completion length. Not remotely triggerable
without the NIC's participation.

## Fix

Clamp/reject before assigning lengths (see README diff) — one comparison.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)