# DF-4387 VERDICT

## Trace

1. `oce_mbox_get_fw_config()` stores the raw firmware dword:
   `sc->port_id = fwcmd->params.rsp.port_id` (`sys/dev/netif/oce/oce_mbox.c:493`)
   — no mask, no range check anywhere in the driver (other uses pass it back
   to the device at oce_mbox.c:1063,1879).
2. `oce_refresh_nic_stats()` → `copy_stats_to_sc_be2()` /
   `copy_stats_to_sc_be3()` index with it:
   - `sys/dev/netif/oce/oce_sysctl.c:1151` — `rxf.port[port]`,
     `oce_rxf_stats_v0.port[2]` (oce_hw.h:2943)
   - `sys/dev/netif/oce/oce_sysctl.c:1216` — `rxf.port[port]`,
     `oce_rxf_stats_v1.port[4]` (oce_hw.h:3004)
   Both then copy ~26 port fields plus `rxf_stats`/`pmem` fields into
   `sc->oce_stats_info.u0.be`.
3. Exposure: every copied field is a `CTLFLAG_RD` sysctl node created at
   attach (`oce_add_stats_sysctls_be3`, oce_sysctl.c:538-752) — readable by
   any user (`sysctl hw.oceN.stats.rx.err.crc_errs` etc.).
4. Allocation: `oce_stats_init()` (oce_sysctl.c:1268-1284) sizes the DMA
   block to exactly `sizeof(struct mbx_get_nic_stats_v0)` /
   `sizeof(struct mbx_get_nic_stats)`, so the OOB read runs off the end of
   the `oce_dma_alloc` mapping into adjacent kernel heap once `port_id`
   outruns the struct (replica arithmetic in `run.log`: port_id 4 already
   clears both the port[] array and the rxf-sized buffer model).

Threat model: device-controlled index (malicious/compromised NIC or DMA),
unprivileged reader harvests the leaked dwords. Missing-validation class,
same family as the DF-1576 device-trust pattern.

## Verification (Phase V)

Kernel path hardware-gated (no `19a2:` device, no `hw.oce` tree — `run.log`).
Demonstrated: exact-geometry replica (`trigger.c`, guest run in `run.log`)
showing which port_id values cross which boundary. `fix.diff` clamps
`port_id` to `NELEM(rxf.port)` at both copy functions; `git apply --check`
OK; patched file syntax-validated on the guest kernel toolchain (0 errors).

## Bottom line

Certain code-wise, device-gated exploit-wise: Low. Two-line defense-in-depth
clamp; worth fixing alongside any broader "validate fw_config" hardening.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.