# DF-4108 VERDICT

**Status: untested (hardware-gated — no VT612x NIC on the audit guest; source-level defect certain, packet-shape reachability contrived → Low/likely)**
**Impact: 8-byte OOB write past a TX descriptor's fragment array into the next descriptor (vge_sts/vge_ctl) — descriptor-accounting corruption; latent mbuf mishandling in vge_txeof if the victim descriptor is in flight.**

## Trace

- Array: `struct vge_tx_desc { uint32_t vge_sts; uint32_t vge_ctl; struct
  vge_tx_frag vge_frag[VGE_TX_FRAGS]; }` (if_vgereg.h:600-607, VGE_TX_FRAGS=7
  at :584). Descriptor stride 64 bytes (8 + 7*8).
- Producer: `vge_encap` sets `arg.vge_maxsegs = VGE_TX_FRAGS` (if_vge.c:1622).
- Callback guard: `if (nseg > ctx->vge_maxsegs) { fail }` (if_vge.c:676) —
  admits nseg == 7.
- Frag fill loop: `for (i = 0; i < nseg; i++) f = &d->vge_frag[i]; ...`
  (690-695) — consumes all 7 slots at nseg==7.
- Pad path for frames < VGE_MIN_FRAMELEN (60): `f = &d->vge_frag[i];` with
  i == nseg == 7 (697-706) → writes addrlo (desc+64..67 = **next
  descriptor's vge_sts**, full overwrite), addrhi (+68..69 → next
  vge_ctl[0:2]), buflen (+70..71 → next vge_ctl[6:8]).
- Consumer effect: `vge_txeof` (1425-1444) walks considx→prodidx testing
  `txstat & VGE_TDSTS_OWN` from `vge_tx_list[idx].vge_sts` — a corrupted
  sts on an in-flight descriptor can make the driver reclaim a descriptor
  the chip still owns (m_freem of a pending mbuf → NIC reads freed cluster)
  or skip one (mbuf leak / oactive stall).
- Trigger shape: pkthdr.len < 60 with exactly 7 DMA segments — not
  generated by ordinary stack output (needs pathological mbuf chopping;
  BPF writes are privileged). Hence Low severity, confidence 'likely'
  (defect certain, reachability contrived).

## Why untested
Guest has no VIA NIC (virtio only); no TX path executes. FreeBSD's later
driver history fixed this exact contract by reserving a fragment
(`maxsegs = VGE_TX_FRAGS - 1` style), corroborating the defect.

## Fix
`arg.vge_maxsegs = VGE_TX_FRAGS - 1;` in vge_encap so the pad fragment
always has a slot (fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.