# DF-4385 — oce_img_flashing_required reads 4 bytes at a fixed ~1.31 MB firmware offset with no bounds check

- **File:** `sys/dev/netif/oce/oce_sysctl.c:449-472` (called from `:334`)
- **Class:** CWE-125 out-of-bounds read (kernel), firmware-image-shaped
- **Threat model:** root writes `hw.oceN.fw_upgrade=<name>`; the referenced
  image was registered via `firmware_get()`. The image bytes are attacker-
  controlled if the file placed in `/boot/kernel` is hostile. Sibling of
  DF-1573 (which enumerated sites 257, 263, 265-273, 297, 322, 515 — this
  site was missed).

## Build / run

No Emulex NIC on the verification guest (`run.log`: 0 `19a2:` PCI devices,
no `hw.oce` sysctl tree), so the kernel path is hardware-gated. The pack
contains:

- `trigger.c` — host-independent replica of the exact arithmetic
  (`crc_offset = hdrs_size + img_offset + img_size - 4`) showing the read
  lands ~1.31 MB into an image that may be a few KB, plus the OOB fault
  demonstration via mmap guard page.
- `run.sh` — guest hardware-gating probe (produces `run.log`).
- `fix.diff` — targeted fix (pass `fw->datasize` in, validate before
  `bcmp`).

## Expected

`./trigger` (on any UNIX-y host with cc): prints the computed read offset,
then `SIGSEGV: OOB read` when the CRC read crosses the guard page — proving
the kernel would read past the firmware buffer on a truncated-but-cookie-
valid image. On the audit guest without oce hardware the path is dormant;
the demonstration is the replica + source trace in VERDICT.md.