# VERDICT DF-4498 — sbsh encap_frame() infinite repack loop on 1–4 byte frames

## Bottom line

**INCONCLUSIVE at runtime (hardware-gated), defect CONFIRMED at source level.**
The loop is provable by pure code logic — no race, no device misbehavior
needed, only a frame with `0 < m_pkthdr.len < 5` in `if_snd` while the unit is
ACTIVE. The QEMU guest has no Granch SBNI12/16 PCI device (`env.txt`), so the
driver never attaches and the frame can never be enqueued.

## Source-level proof

1. `start_xmit_frames()` dequeues any mbuf with nonzero `m_pkthdr.len` and
   calls `encap_frame()` (`if_sbsh.c:636-643`).

2. `encap_frame()` loop head (`:660-672`):
   ```c
   look_for_nonzero:
       for (m = m_head; !m->m_len; m = m->m_next) ;
       cur_tbd = sc->regs->LTDR & 0x7f;
       do {
           if (m->m_len < 5 || cur_tbd == ((sc->head_tdesc - 1) & 0x7f)) {
               if ((m_head = repack(sc, m_head)) != NULL)
                   goto look_for_nonzero;
               else
                   return;
           }
   ```

3. `repack()` always produces `m_new->m_pkthdr.len = m_new->m_len =
   m->m_pkthdr.len` (`:720-721`). For a 1–4 byte frame the repacked mbuf has
   `m_len < 5` again, so the `goto look_for_nonzero` path re-tests the same
   condition on a fresh 1–4 byte mbuf — **unbounded
   allocate / copy / free cycle**.

4. The cycle runs in the caller's context holding `ifp->if_serializer`
   (network thread / syscall path via `sbsh_start`, `:313-321`), with
   `M_NOWAIT` allocations that keep succeeding under normal memory pressure —
   the only exit is mbuf exhaustion, which the loop itself prevents by freeing
   what it allocates. Result: permanent kernel-mode spin on one CPU with the
   interface serializer held (livelock DoS; everything that touches the ifnet
   or takes that serializer blocks).

5. Secondary defect on the same lines: when `repack()` fails (returns NULL),
   `encap_frame()` returns without freeing `m_head` — the dequeued packet is
   leaked (`:668-671`).

## Injection vectors (why Low and not Medium)

* `/dev/bpf` write of a runt frame — requires root/group on the bpf node
  (default root-only on DF).
* Bridge member ingress: if `sbsh0` is a bridge member, an **unprivileged LAN
  peer** on another member port can emit a runt frame that
  `bridge_output()` forwards into `if_snd` (bridges do not enforce a minimum
  frame size). Config-dependent.
* Normal stack paths (ether_output ≥ 14 bytes) cannot produce it.

## Why not `reproduced`

`sbsh0` cannot exist on this guest (PCI 0x55:0x9d absent — `env.txt`);
trigger compiled (`build.log`) and failed only at `BIOCSETIF`
(`run.log`).

## Fix

`fix.diff`: (1) `repack()` refuses frames `< 5` bytes (returns NULL → caller
drops); (2) `encap_frame()` frees `m_head` on the repack-failure path, fixing
the leak as well.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.