{
  "finding_id": "DF-4638",
  "status": "untested",
  "reproduced": 0,
  "impact": "none demonstrated (latent API hazard): any future caller of e1000_read_posted_mbx/e1000_write_posted_mbx with size > mbx->size(16) gets an unconditional ops.read/ops.write word loop (e1000_mbx.c:476-477/:512-513/:697-698/:736-737) past its buffer \u2014 kernel overflow with PF-controlled mailbox content plus OOB E1000_VMBMEM register-array writes; all in-tree callers (e1000_vf.c) pass sizes 1/2/3/16 with correctly sized buffers",
  "confidence": "certain",
  "verdict": "not_run as PoC by design: this is a hardening gap with no overflowing caller in the current tree (verified by exhaustive caller sweep \u2014 e1000_vf.c is the only user of the posted API; e1000_api.c dispatches VF ops for igbs 82576_VF/I350_VF attach path). The size discipline exists only in the non-posted wrappers (read clamp e1000_mbx.c:80-81, write reject :105-106); the posted wrappers call ops.read/ops.write directly (:260, :287) with the callers size unvalidated. No igb/SR-IOV hardware on the guest (virtio-only, env.txt). fix.diff (mirror sibling checks) is git-apply-clean and compile-validated against X86_64_GENERIC headers on the guest (FIXED_CC_RC=0, build.log).",
  "exploit_chain": [],
  "evidence": "VERDICT.md (clamp/reject vs direct-dispatch line cites; caller sweep; killed-class list); build.log (on-guest baseline+patched cc -fsyntax-only RC=0); env.txt (no e1000 hardware on guest); fix.diff (git-apply-clean)",
  "kernel_refs": [
    "sys/dev/netif/ig_hal/e1000_mbx.c:80",
    "sys/dev/netif/ig_hal/e1000_mbx.c:105",
    "sys/dev/netif/ig_hal/e1000_mbx.c:260",
    "sys/dev/netif/ig_hal/e1000_mbx.c:287",
    "sys/dev/netif/ig_hal/e1000_mbx.c:512",
    "sys/dev/netif/ig_hal/e1000_mbx.c:736",
    "sys/dev/netif/ig_hal/e1000_vf.c:385",
    "sys/dev/netif/igb/if_igb.c:108"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC; the actionable artifact is fix.diff, compile-validated on the guest",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "notes": "Pass-2 depth on the rest of the file (all killed, see VERDICT.md): poll loops bounded (timeout u32, 2000x500us, latches fail-forever on exhaustion); obtain-lock loops bounded 10x1ms; PF-side MBVFICR 1<<vf_number shift UB is dead code (no PF SR-IOV driver in tree); init_mbx_params_pf missing break cosmetic; NULL-dispatch guards complete; no fw/VF-controlled count reaches a loop bound in this file.",
  "recommended_fix": "Mirror the sibling checks into the posted wrappers: clamp size to mbx->size in e1000_read_posted_mbx before ops.read, and reject size > mbx->size in e1000_write_posted_mbx (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "compile-validated only: fix.diff applies cleanly (git apply --check) and cc -fsyntax-only passes against the running kernels headers on the guest for both baseline and patched file (BASE_CC_RC=0/FIXED_CC_RC=0, build.log); runtime validation impossible on this virtio-only guest (no igb/VF device)",
  "fix_evidence": "fix.diff; build.log"
}