{"finding_id":"DF-4757","status":"untested","attempts":0,"reproduced":0,"impact":"corruption","confidence":"likely","verdict":"Branch inversion confirmed by direct source read (orchestrator sanity-check): ena_com.c:657-661 assigns SINGLE_DESC_PER_ENTRY -> desc_list_entry_size/64 while the runtime walk ena_eth_com.c:202-206 gives SINGLE -> 1 (and MULTIPLE -> entry/64), matching vendor enum docs; ena_com_sq_have_enough_space consumes the inverted config so on SINGLE-stride LLQ devices the free-space guard undercounts ~2x and the SQ tail can lap outstanding descriptor lines (masked in-bounds writes - device-contract corruption, not guest OOB). Requires an ENA device advertising SINGLE-stride LLQ; none on the QEMU guest. Two-line swap fix.","exploit_chain":"SINGLE-stride LLQ device + burst of fragmented mbufs -> have_enough_space permits ~2x the available lines -> tail overwrites unfetched descriptor lines of in-flight packets -> tx corruption/resets","evidence":"findings/poc/DF-4757/ (this verdict; source excerpts in reviewer notes)","kernel_refs":["sys/dev/virtual/amazon/ena/ena-com/ena_com.c:657-661","sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:202-206","sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.h:113-129"],"guest_uname":"","code_hash":""}