{
  "finding_id": "DF-4794",
  "status": "untested",
  "reproduced": 0,
  "impact": "none demonstrated at runtime (guest is virtio-only, no SR-IOV 82576/I350 VF device); logic-level proven from source ordering + upstream divergence: with >30 multicast groups joined on an igb VF interface, PF-visible msgbuf[0]=0x001E0003 loses E1000_VF_SET_MULTICAST_OVERFLOW (0x00800000), PF never enables multicast promiscuous, groups beyond the 30 forwarded hashes silently stop receiving (typ. IPv6 solicited-node/ND breakage) — availability only, no corruption/leak/privilege crossing",
  "confidence": "certain",
  "verdict": "not runnable on the audit guest by hardware absence: e1000_update_mc_addr_list_vf() (e1000_vf.c:400-437) is live code for igb VF attach (if_igb.c:108/123 -> e1000_api.c:392-397/510-514 -> igb_set_multi if_igb.c:1304), but the mailbox data path needs an actual 82576/I350 VF behind an SR-IOV PF; guest pciconf shows no e1000 device (env.txt). Root cause is certain from source: e1000_vf.c:422 ORs E1000_VF_SET_MULTICAST_OVERFLOW into msgbuf[0], then :426 unconditionally assigns msgbuf[0]=E1000_VF_SET_MULTICAST, destroying the flag before e1000_write_msg_read_ack (:436) sends 16 words; FreeBSD current assigns SET_MULTICAST first and ORs OVERFLOW after (upstream keeps the flag). Deterministic arithmetic demo on the guest (run.log): current 0x001E0003 vs fixed 0x009E0003 for count>30. fix.diff hunk 2 mirrors upstream; compile-validated on guest BASE_CC_RC=0/FIXED_CC_RC=0 (build.log) and git apply --check clean.",
  "exploit_chain": "",
  "evidence": "run.log (mcmsg_demo decisive lines: CURRENT 0x001e0003 flag-not-set vs FIXED 0x009e0003 flag-SET); VERDICT.md (root cause path:line, reachability chain, kill list); build.log (guest compile validation, source sha256 match c0cdce6b...); env.txt (no e1000 hardware); fix.diff (git-apply-clean, hunk 2 = this finding)",
  "kernel_refs": [
    "sys/dev/netif/ig_hal/e1000_vf.c:421",
    "sys/dev/netif/ig_hal/e1000_vf.c:422",
    "sys/dev/netif/ig_hal/e1000_vf.c:426",
    "sys/dev/netif/ig_hal/e1000_vf.c:436",
    "sys/dev/netif/ig_hal/e1000_mbx.h:82",
    "sys/dev/netif/igb/if_igb.c:1304",
    "sys/dev/netif/ig_hal/e1000_api.c:510"
  ],
  "poc_changes": "no seeded PoC; authored mcmsg_demo.c (deterministic logic demo of the msgbuf[0] arithmetic with real e1000_mbx.h macro values) + combined fix.diff",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o mcmsg_demo mcmsg_demo.c (guest, RC=0); cc -fsyntax-only -D_KERNEL -I/usr/obj/usr/src/sys/X86_64_GENERIC -I/usr/src/sys -I/usr/src/sys/dev/netif/ig_hal {base,fixed}.c (RC=0/RC=0)",
  "run_cmd": "./mcmsg_demo",
  "code_hash": "7c25206611722c7c067c8308d7a139be0f53af5b24ed4e5ef4134dea5ad90791",
  "notes": "Pass-2 e1000_vf.c. Sibling DF-4795 (uninit stack tail in same message) shares fix.diff hunk 1. All other pass-2 candidates on this file killed (VERDICT.md kill list): every mbx read/write size <= buffer; hash writes exactly fit 64B msgbuf; shift loop terminates (constant mta_reg_count=128); all waits bounded; no NULL-op dispatch.",
  "recommended_fix": "Mirror upstream ordering: assign msgbuf[0]=E1000_VF_SET_MULTICAST before OR-ing E1000_VF_SET_MULTICAST_OVERFLOW in the >30 branch (else-branch plain assign), and zero-initialize msgbuf (fix.diff hunk 2; hunk 1 belongs to DF-4795).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "compile-validated only: fix.diff git apply --check clean; patch(1) applied both hunks on guest copy of pristine file; cc -fsyntax-only BASE_CC_RC=0 / FIXED_CC_RC=0 with only the pre-existing systm.h:216 warning (build.log); runtime fix-validation impossible on this virtio-only guest (no igb/VF device)",
  "fix_evidence": "fix.diff; build.log; env.txt"
}