{
  "finding_id": "DF-4816",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static-proof finding, Low severity. iwm_phy_db_set_section() takes the firmware-supplied channel-group id (chg_id) verbatim (if_iwm_phy_db.c:279,:293) with no upper bound: the first CHG notification of a type allocates (chg_id+1)*16 bytes (up to 1 MiB) with M_WAITOK|M_ZERO from the RX interrupt path (iwm_intr -> iwm_notif_intr -> iwm_handle_rxb -> iwm_notification_wait_notify -> iwm_wait_phy_db_entry, if_iwm.c:2831), and subsequent per-index chunks accumulate M_DEVBUF bounded only by the calibration wait timeout. Independently, iwm_phy_db_send_all_channel_groups() takes the group count as uint8_t (if_iwm_phy_db.c:455-458) while callers pass the int n_group_papd/n_group_txp (if_iwm_phy_db.c:541-542,:551-552): counts >=256 truncate mod 256 (calibration groups silently never uploaded to the runtime firmware), and the init value -1 becomes 255, making get_section() return NULL and send_all_channel_groups() return EINVAL so iwm_send_phy_db_data() fails and iwm_load_firmware() aborts (if_iwm.c:4856-4857) - a device DoS when the firmware sends no channel groups. Not kernel memory corruption (truncation can only shrink the loop; entry->size always equals the allocation), and not reachable by an unprivileged local user: the only trigger is a firmware-emitted IWM_CALIB_RES_NOTIF_PHY_DB notification. Runtime reproduction impossible on the audit guest: pciconf shows no Intel Wireless 7265/8000+ device and no iwm module (DragonFly 6.5-DEVELOPMENT X86_64_GENERIC QEMU guest, verified this run).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full static proof with call chain and C-conversion analysis); README.md (trigger description); fix.diff (chg_id cap at 255 + int-typed group count + skip non-positive counts)",
  "kernel_refs": [
    "sys/dev/netif/iwm/if_iwm_phy_db.c:279",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:285-290",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:293",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:299-304",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:455-458",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:541-542",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:551-552",
    "sys/dev/netif/iwm/if_iwm.c:2831",
    "sys/dev/netif/iwm/if_iwm.c:4856"
  ],
  "poc_changes": "No seed PoC existed; no runnable PoC is possible without the iwm NIC and a hostile firmware image (RX notifications are DMAd by the device, not injectable via syscalls). Pack documents the trigger and the static proof instead.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Guest verified to lack the hardware: pciconf -l shows 7 QEMU devices, no 8086:095a/095b/24f*/08b1 wireless, no iwm/amdgpu modules loaded. Distinct from known DF-1898 (fw length vs actual RX packet size -> OOB read of the rx buffer): this finding is about the chg_id VALUE (allocation size + send-loop count truncation), a different sink with no OOB. Heritage: Linux iwlwifi 3.14 base had the same truncation; upstream later added group-count validation. fix_status=not_testable because the driver cannot attach on the guest.",
  "recommended_fix": "Cap firmware-supplied chg_id at 255 in iwm_phy_db_set_section (EINVAL otherwise), change iwm_phy_db_send_all_channel_groups max_ch_groups param to int, and skip send when n_group_papd/n_group_txp <= 0",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (cap + int count + non-positive skip). Not testable: the guest has no Intel Wireless 7265+ NIC, so neither baseline nor patched kernel can execute the calibration path. Compile-correctness of the diff verified by inspection (types and call sites updated consistently).",
  "fix_evidence": "findings/poc/DF-4816/fix.diff"
}