# DF-4107 VERDICT

**Status: untested (hardware-gated — no VT612x NIC on the audit guest; source-level certainty certain)**
**Impact: heap OOB read of up to ~14 KB per hostile descriptor handed to the network stack and BPF; negative-length (-4) mbuf on BUFSIZ=0. Read-side primitive only — no write.**

## Trace

- Descriptor status is DMA-written by the NIC; the driver never re-derives
  the length from its own bookkeeping:
  - if_vge.c:1268 `total_len = VGE_RXBYTES(cur_rx);`
  - if_vgevar.h:55-56 `VGE_RXBYTES(x) = ((le32toh((x)->vge_sts) & VGE_RDSTS_BUFSIZ) >> 16)`
  - if_vgereg.h:676 `VGE_RDSTS_BUFSIZ 0x3FFF0000` → range 0..16383.
- Single-frag EOF path: if_vge.c:1361-1363 assigns
  `m->m_pkthdr.len = m->m_len = total_len - ETHER_CRC_LEN` **with no
  MCLBYTES clamp**. The mbuf is a single 2048-byte cluster
  (vge_newbuf:1111-1134, m_getcl + load with maxsize MCLBYTES at
  if_vge.c:765-768).
- BUFSIZ=0x3FFF → m_len = 16379 → 14331 bytes past the cluster end are
  parsed as packet content by ether_input→IP/TCP and copied to BPF taps —
  kernel heap disclosure / parsing of adjacent slab contents; classic
  DF-3604/DF-4055/DF-4083 family.
- BUFSIZ=0..3 with RXOK (or VIDM/CSUMERR pass-through at 1308-1309) →
  `m_len = -4` (int) → negative-length mbuf into if_input.
- Multi-frag tail (1342) is modular-bounded by luck, but pkthdr.len at
  1360 is not bounded against the chain sum.

## Preconditions / threat model

A DMA-written descriptor length is trusted. Attack vectors: (a) malicious
or mis-programmed NIC (Thunderbolt/PCIe peripheral with DMA), (b) NIC
firmware errata, (c) any kernel bug that scribbles descriptor memory.
This is exactly the posture the sibling findings (DF-3604 Medium,
DF-4055 Medium, DF-4083 Medium) were filed under — consistent Medium.

Not DF-1381/DF-1382: those cover the newbuf chunk-decrement OOB write and
the SIOCSIFMTU clamp respectively; this is the rxeof length consumer.

## Why untested

Guest exposes no VIA NIC (pciconf -l: virtio 1af4:1000 only; ifconfig:
vtnet0 lo0). No in-guest path executes vge_rxeof. Source trace is
line-exact; the clamp-fix is mechanical.

## Fix

Bound `total_len` to the actual buffer size before it reaches m_len /
pkthdr.len (and drop frames with total_len <= ETHER_CRC_LEN). fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.