{
  "finding_id": "DF-4083",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sis_rxeof (if_sis.c:1373-1374,1396) copies SIS_RXBYTES(cur_rx) — a 12-bit DMA-written descriptor field minus 4 (if_sisreg.h:314,324), range [-4,4091] — directly into m_len/m_pkthdr.len of an MCLBYTES (2048) cluster with no clamp against MCLBYTES or the programmed SIS_RXLEN (1536). A device writing BUFLEN=0xFFF produces m_len=4091, so stack consumers read up to 2043 bytes past the cluster into adjacent kernel heap and deliver it to sockets/BPF: kernel info leak (DF-3604 bce family, sis flavor). Untested: QEMU has no SiS 900/7016/DP83815 model; guest pciconf shows no 0x1039/0x100b devices. Source-level certainty.",
  "exploit_chain": "",
  "evidence": "README.md, VERDICT.md. Key lines: if_sis.c:1374 (SIS_RXBYTES), 1395-1397 (no-clamp assignment), 1405 (if_input), 1296/1302/1305 (2048-byte cluster), if_sisreg.h:314/324 (12-bit mask), 472 (SIS_RXLEN 1536).",
  "kernel_refs": ["sys/dev/netif/sis/if_sis.c:1374", "sys/dev/netif/sis/if_sis.c:1396", "sys/dev/netif/sis/if_sis.c:1405", "sys/dev/netif/sis/if_sisreg.h:314", "sys/dev/netif/sis/if_sisreg.h:324", "sys/dev/netif/sis/if_sisreg.h:472"],
  "poc_changes": "No runnable PoC: hardware-gated (no SiS emulation in QEMU). Pack documents the exact descriptor shape (sis_cmdsts = PKT_OK|0xFFF + in-frame ip_len<=4091) needed on real hardware.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Impact ceiling: per-frame ~2 KB kernel heap disclosure to socket/BPF readers, driven by NIC firmware/DMA fault or hostile peer with device access; secondary negative-length edge (BUFLEN<4 -> negative m_len) is dropped by the stack. Matches DF-3604 (bce) severity precedent (Medium/kernleak).",
  "recommended_fix": "In sis_rxeof, reject/clamp total_len to [ETHER_HDR_LEN, MCLBYTES] before assigning m->m_pkthdr.len = m->m_len = total_len.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not possible: no SiS hardware/emulation in QEMU.",
  "fix_evidence": "Guest pciconf -l: no vendor 0x1039/0x100b devices."
}