{
  "finding_id": "DF-4645",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Twin of DF-4638 confirmed statically: ixgbe_read_posted_mbx (ixgbe_mbx.c:238) and ixgbe_write_posted_mbx (ixgbe_mbx.c:266) dispatch to the raw mbx ops with unvalidated size, bypassing the clamp (ixgbe_mbx.c:55-56) and reject (ixgbe_mbx.c:80-83) enforced only by the non-posted wrappers; the raw VF/PF ops trust size verbatim over a fixed 16-word/64-byte mailbox window, so a future size>16 caller gets kernel-OOB-read-to-MMIO on write and cross-VF mailbox spill on both directions. Not runnable today: the DF ix driver has no SR-IOV/VF support and zero in-tree callers of any mailbox message op (only if_ix.c:535 init_params), and the verification guest has no ixgbe-class PCI device (virtio-only). Filed Info/latent exactly like the ig_hal twin. Guest probed read-only and left clean.",
  "exploit_chain": "",
  "evidence": "static-proof.txt (exhaustive zero-caller grep), env.txt (guest: no ixgbe device, if_ix compiled-in but dormant), VERDICT.md (full path:line trace), fix.diff (clamps read / rejects write inside posted wrappers)",
  "kernel_refs": [
    "sys/dev/netif/ix/ixgbe_mbx.c:224",
    "sys/dev/netif/ix/ixgbe_mbx.c:238",
    "sys/dev/netif/ix/ixgbe_mbx.c:253",
    "sys/dev/netif/ix/ixgbe_mbx.c:266",
    "sys/dev/netif/ix/ixgbe_mbx.c:55",
    "sys/dev/netif/ix/ixgbe_mbx.c:80",
    "sys/dev/netif/ix/ixgbe_mbx.c:445",
    "sys/dev/netif/ix/ixgbe_mbx.c:683",
    "sys/dev/netif/ix/ixgbe_mbx.h:40",
    "sys/dev/netif/ix/ixgbe_type.h:455",
    "sys/dev/netif/ix/if_ix.c:535"
  ],
  "poc_changes": "no PoC exists to change: the finding is latent (no in-tree trigger path, no hardware on guest); verification was static caller analysis + guest hardware-absence capture instead",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "IDs DF-4645 reserved by orchestrator. DF-4638 (ig_hal e1000_mbx) is the sibling finding filed by the orchestrator at Info/memcorrupt; this is the ixgbe twin, deader still (igb at least has a VF path, ix has none). Fix validated only by inspection: no trigger path exists, so a patched-kernel run would be observationally identical; fix build skipped as theater.",
  "recommended_fix": "Mirror the non-posted wrappers size discipline inside ixgbe_read_posted_mbx (clamp size to mbx->size) and ixgbe_write_posted_mbx (reject size > mbx->size with IXGBE_ERR_MBX) \u2014 see fix.diff.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff mirrors non-posted discipline (clamp read, reject write) at the exact dispatch sites (ixgbe_mbx.c:238, 266); not kernel-build-validated because the bug has no in-tree trigger path and the guest has no ixgbe hardware \u2014 a patched kernel is observationally identical under any runnable test.",
  "fix_evidence": "findings/poc/DF-4645/fix.diff; VERDICT.md Fix section"
}