{
  "finding_id": "DF-4130",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain data flow: the firmware response field rsp.db_offset (NIC_CREATE_WQ V2) is stored unvalidated into wq->db_offset (oce_mbox.c:1710-1711) and used verbatim as the bus_space offset of a 32-bit MMIO write on every TX doorbell (oce_if.c:949); x86 bus_space_write_4 does no range check, so hostile firmware can aim semi-controlled 4-byte writes at kernel memory relative to the BAR map. Cannot be exercised on the audit guest: QEMU has no Emulex OCE device model and none is attached (hw_absent.log) — hardware-gated finding, filed for upstream robustness hardening.",
  "exploit_chain": "",
  "evidence": "hw_absent.log (no Emulex PCI device, no /dev/oce*, no if_oce.ko on the audit guest); source cites in README.md",
  "kernel_refs": ["sys/dev/netif/oce/oce_mbox.c:1710", "sys/dev/netif/oce/oce_mbox.c:1711", "sys/dev/netif/oce/oce_if.c:949", "sys/dev/netif/oce/oce_if.h:925"],
  "poc_changes": "no seed; source-trace only (hardware-gated class, consistent with DF-1395/DF-1396 handling)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "n/a (no OCE hardware; source-level verification)",
  "run_cmd": "pciconf -l | grep -i emulex  (negative — device absent)",
  "code_hash": "",
  "notes": "Firmware-trust robustness finding, same threat family as DF-1395/1396 but weaker (MMIO offset, not heap overflow). Not re-reporting DF-1395/DF-1396.",
  "recommended_fix": "validate rsp.db_offset against the driver-known doorbell register (PD_TXULP_DB) or clamp to the BAR range before first TX doorbell use",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix not runtime-testable: the affected code path requires an Emulex OCE NIC which the QEMU guest cannot provide",
  "fix_evidence": "hw_absent.log"
}