# DF-4386 — hw.oceN.firmware_version can serve an unbounded strlen() over a non-NUL-terminated device string (kernel heap bytes to unprivileged readers)

- **Registration:** `sys/dev/netif/oce/oce_sysctl.c:84-89`
  (`SYSCTL_ADD_STRING(.., &sc->fw_version, sizeof(sc->fw_version), ..)`)
- **Fill:** `sys/dev/netif/oce/oce_mbox.c:289` —
  `bcopy(fwcmd->params.rsp.fw_ver_str, sc->fw_version, 32);` copies exactly
  32 device-controlled bytes; the device is *not* required to NUL-terminate.
- **Sink:** `sys/kern/kern_sysctl.c:1171` —
  `SYSCTL_OUT(req, arg1, strlen((char *)arg1)+1);` — strlen is **not**
  bounded by `arg2` (32).

If all 32 bytes are non-NUL, strlen walks out of `fw_version` into the rest
of `struct oce_softc` (`macaddr`, then `OCE_DMA_MEM bsmbx` — kernel virtual
pointers), and `SYSCTL_OUT` copies `strlen+1` bytes to **any unprivileged
user** running `sysctl hw.oceN.firmware_version`. Reading sysctls needs no
privilege on DragonFly.

## Build / run

`./run.sh` — hardware gate (no oce NIC on this guest) + guarded replica of
the strlen walk: 32 non-NUL device bytes followed by non-zero adjacent
fields → strlen walks +55 bytes past the buffer.

## Expected

`t6`-style output: `strlen() walked: 87 bytes (+55 past the buffer)`,
`RESULT: strlen OOB confirmed`. Kernel-path confirmation needs an Emulex
adapter whose GET_FW_VERSION response fills all 32 bytes.