{
  "finding_id": "DF-4108",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-level defect certain, reachability contrived: vge_encap admits nseg == VGE_TX_FRAGS (7) via maxsegs at if_vge.c:1622, and vge_dma_map_tx_descs short-frame pad then writes frag[7] (if_vge.c:697-706) - 8 bytes past the 64-byte descriptor into the rings next vge_tx_desc.vge_sts/vge_ctl. If that descriptor is in flight, vge_txeofs OWN-bit walk (1425-1444) can reclaim/skip it wrongly (free an mbuf the NIC still reads). Triggering needs a <60-byte frame spanning 7 DMA segments - not produced by normal stack output; hence Low. Untestable on guest (no VT612x).",
  "exploit_chain": "",
  "evidence": "VERDICT.md: descriptor layout math (stride 64, frag[7] at +64..71), the 676 guard analysis, and the vge_txeof consumer consequence.",
  "kernel_refs": [
    "sys/dev/netif/vge/if_vge.c:1622",
    "sys/dev/netif/vge/if_vge.c:676",
    "sys/dev/netif/vge/if_vge.c:699",
    "sys/dev/netif/vge/if_vgereg.h:606",
    "sys/dev/netif/vge/if_vge.c:1427"
  ],
  "poc_changes": "No runnable PoC (hardware absent + pathological mbuf shape needed); pack is the trace + one-line reserve fix.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (NIC = virtio vtnet0; no VIA 1106:3053)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardware-gated. Intra-allocation OOB (within the DMA ring), so no kernel-heap corruption beyond descriptor bookkeeping. Checklist item (b) TX completion walks themselves are correctly modular (VGE_TX_DESC_INC, 1425-1444).",
  "recommended_fix": "Reserve one fragment for the pad entry: arg.vge_maxsegs = VGE_TX_FRAGS - 1 (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line fix guarantees the pad write stays inside vge_frag[0..6]; not exercisable on the guest (no VT612x hardware).",
  "fix_evidence": "findings/poc/DF-4108/fix.diff"
}