# DF-4326 — sf(4) RX completion endidx OOB write past the whole descriptor block

**File:** sys/dev/netif/sf/if_sf.c:940 (`sf_rxeof`)

`cur_rx->sf_endidx` is an 11-bit buffer-descriptor index DMA-written by the
AIC-6915. The driver does `desc = &sf_rx_dlist_big[sf_endidx]` with **no
bounds check** against `SF_RX_DLIST_CNT` (256). Values 256..2047 dereference
up to 1792 entries past the array; `sf_newbuf()` (if_sf.c:892-894) then
WRITES there: an mbuf pointer (8 bytes), a 30-bit DMA address + valid bit.
endidx=2047 lands 12,272 bytes past the END of the entire 40,960-byte
contigmalloc'd `struct sf_list_data` — i.e. straight into adjacent kernel
heap, with semi-controlled content.

Distinct from DF-1526 (that finding covers the *length* `sf_len` and the
RXDQ buffer-length misprogramming; this is the *descriptor index*).

## Build / Run
Same module as DF-4325. `sysctl kern.sfrh.run=3`
Expected (run.log): canary bytes past the block end clobbered with exactly
the planted mbuf pointer/DMA address; "OOB WRITE PAST sf_list_data PROVEN".