# DF-4386 VERDICT

## Trace

1. `oce_get_fw_version()` (`sys/dev/netif/oce/oce_mbox.c:260-292`) issues
   OPCODE_COMMON_GET_FW_VERSION; the response payload
   `fwcmd->params.rsp.fw_ver_str` (`uint8_t [32]`, oce_hw.h:1509) is
   device-DMA'd. `:289` `bcopy(fw_ver_str, sc->fw_version, 32)` copies
   exactly `sizeof(sc->fw_version)` bytes — a full-width copy overwrites any
   NUL, so termination depends entirely on device bytes.
2. `oce_add_sysctls()` (`sys/dev/netif/oce/oce_sysctl.c:84-89`) publishes the
   buffer as `CTLFLAG_RD` SYSCTL_ADD_STRING.
3. On read, `sysctl_handle_string()` (`sys/kern/kern_sysctl.c:1171`) does
   `SYSCTL_OUT(req, arg1, strlen((char *)arg1)+1)` — strlen is unbounded by
   the oid's `arg2`. (Contrast the write path at :1176-1181, which *is*
   bounded by `arg2`.)
4. Layout: `fw_version` (`oce_if.h:835`) is followed by
   `struct mac_address_format macaddr` and `OCE_DMA_MEM bsmbx`
   (`bus_dma_tag_t`/vaddr/paddr kernel pointers). The leaked window runs
   until the first zero byte; kernel pointers contain zero bytes so the walk
   stops within tens of bytes — but those tens of bytes (mac, DMA pointers)
   are copied to userspace verbatim.

Threat model: requires a device (or device firmware compromise) returning a
non-NUL-terminated version string — malicious-peripheral class. The *reader*
needs no privilege: `sysctl hw.oceN.firmware_version` is world-readable.

## Verification (Phase V)

- Kernel path hardware-gated: no `19a2:` PCI device, no `hw.oce` sysctl
  tree on the guest (`run.log`).
- `trigger.c` guarded replica on the guest (`t6_guarded_run.log`):
  32 non-NUL bytes + adjacent non-zero fields → `strlen() walked: 87 bytes
  (+55 past the buffer)` — the exact sink behavior at kern_sysctl.c:1171.
- `fix.diff` (ocean_mbox.c): force `sc->fw_version[31] = '\0'` after the
  bcopy; `git apply --check` OK; patched `oce_mbox.c` syntax-validated on
  the guest kernel toolchain (0 errors).

## Bottom line

Certain code-wise, device-gated exploit-wise: Low-severity kernel info leak
(adjacent softc bytes incl. kernel pointers) to unprivileged readers. The
same unbounded-strlen string-sysctl pattern should be audited repo-wide
(kern_sysctl.c:1171 is the sink every CTLFLAG_RD string oid relies on).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.