# DF-4387 — Device-controlled `sc->port_id` indexes `rxf.port[]` unchecked in the BE2/BE3 stats copy (OOB read → world-readable sysctls)

- `sys/dev/netif/oce/oce_mbox.c:493` — `sc->port_id = fwcmd->params.rsp.port_id;`
  (raw firmware `uint32_t`, never range-checked)
- `sys/dev/netif/oce/oce_sysctl.c:1146,1151` — `copy_stats_to_sc_be2`:
  `port_stats = &nic_mbx->params.rsp.stats.rxf.port[port];` where `port[2]`
  (oce_hw.h:2943)
- `sys/dev/netif/oce/oce_sysctl.c:1211,1216` — `copy_stats_to_sc_be3`: same,
  `port[4]` (oce_hw.h:3004)

~66 dwords are then copied from `port_stats` into `sc->oce_stats_info`, whose
fields are published world-readable under `hw.oceN.stats.rx.*` /
`hw.oceN.stats.tx.*`. `port_id ≥ 2` (BE2) / `≥ 4` (BE3) reads past the port
array; a large enough `port_id` reads past the entire
`mbx_get_nic_stats{,_v0}` DMA allocation (`oce_stats_init` sizes `stats_mem`
to exactly the struct) into adjacent kernel heap — and those bytes land in
world-readable sysctls.

## Build / run

`./run.sh` — hardware gate + replica printing the read offsets for
port_id 0..5 against the real array/struct geometry.

## Expected

`port_id=4: read at rxf+1056 [PAST port[] ARRAY] [PAST mbx_get_nic_stats
DMA BUFFER]`-style lines. Kernel confirmation needs an Emulex adapter whose
QUERY_FW_CONFIG returns port_id ≥ array bound.