# DF-4638 — ig_hal: posted mailbox wrappers bypass the size clamps their non-posted siblings enforce

File: `sys/dev/netif/ig_hal/e1000_mbx.c` (pass 2, GLM 5.3)

## What

- `e1000_read_mbx()` (e1000_mbx.c:80-81) **clamps** `size` down to `mbx->size` before
  dispatching to `ops.read` — this is what prevents `ops.read` (the `for (i = 0; i <
  size; i++) msg[i] = E1000_READ_REG_ARRAY(...)` loop at e1000_mbx.c:736-737 / :512-513)
  from walking past the caller's buffer.
- `e1000_write_mbx()` (e1000_mbx.c:105-106) **rejects** `size > mbx->size`.
- The posted variants call `ops.read`/`ops.write` **directly, with no size handling at
  all**: `e1000_read_posted_mbx()` at e1000_mbx.c:260 and `e1000_write_posted_mbx()` at
  e1000_mbx.c:287.

Today every in-tree caller (all in `e1000_vf.c`: :283/:288/:334/:337/:385-388/:436/
:498/:501/:559) passes size ∈ {1,2,3,16} ≤ `mbx->size` = 16 (`E1000_VFMAILBOX_SIZE`,
set at e1000_mbx.c:540/:766), with correctly sized stack buffers — so there is **no
demonstrable overflow on the current tree**. The hazard is latent: the VF mailbox API is
live code (the igb driver attaches to 82576_VF/I350_VF PCI IDs — if_igb.c:108/:123 — and
dispatches through e1000_api.c:511/:514 to `e1000_init_function_pointers_vf`), and any
future caller of the posted API with `size > mbx->size` gets a kernel stack/heap
overflow filled with PF-controlled mailbox words, plus out-of-range `E1000_VMBMEM`
register-array writes.

Severity: **Info** (defense-in-depth / API hardening). Confidence: certain (the missing
checks are source facts; the impact statement is explicitly latent).

## Reproduce

Nothing to run — this is a hardening gap. The fix was compile-validated on the audit
guest against the running kernel's headers:

```sh
# build.log (guest session):
cc -fsyntax-only -D_KERNEL -I/usr/obj/usr/src/sys/X86_64_GENERIC \
   -I/usr/src/sys -I/usr/src/sys/dev/netif/ig_hal e1000_mbx_fixed.c   # FIXED_CC_RC=0
```

`fix.diff` mirrors the sibling checks into the posted wrappers (read clamps, write
rejects) — git-apply-clean against `sys/`.