# DF-4833 — iwm_send_cmd TFD TB0 length-field truncation at the wide-header payload boundary

## What this is

Unit-level reproduction of the TFD (Transmit Frame Descriptor) TB0 length
encoding used by `iwm_send_cmd()` — `sys/dev/netif/iwm/if_iwm_util.c:282-283`:

```c
desc->tbs[0].hi_n_len = htole16(iwm_get_dma_hi_addr(paddr)
    | ((hdrlen + paylen) << 4));
```

`struct iwm_tfd_tb.hi_n_len` is a `uint16_t` whose bits 0-3 carry DMA address
bits [35:32] and bits 4-15 carry the buffer length — a 12-bit field, max 4095
(`sys/dev/netif/iwm/if_iwmreg.h:1852-1858`). The hardware spec documented in
the same header caps a single transmit buffer at (4K - 4) = 4092 bytes
(`if_iwmreg.h:1882-1883`).

`iwm_send_cmd()` accepts `paylen` up to `IWM_MAX_CMD_PAYLOAD_SIZE` = 4088
(`if_iwmreg.h:6881`, checked at `if_iwm_util.c:220`). That constant was
derived for the 4-byte legacy header (`(4096-4) - sizeof(struct
iwm_cmd_header)`), but a command with a non-zero group id uses the 8-byte
wide header (`if_iwm_util.c:205-212`, `if_iwmreg.h:6866-6874`). With
`hdrlen=8`, `paylen=4088`:

* `hdrlen + paylen == 4096` — already 4 bytes over the hw per-buffer cap, and
* `(4096 << 4) & 0xFFFF == 0` — the 17th bit falls off the `uint16_t` and the
  firmware-visible TB0 length becomes **zero**: the command payload is
  invisible to the firmware.

`paylen` 4085..4087 (wide) also violate the 4092 hw cap (encode 4093..4095).

## Impact

Firmware-side only: the fw DMA-fetches 0 bytes (or, for 4085-4087, an
over-cap length) for that command — command loss / potential fw SYSASSERT →
radio reset. **No kernel memory-safety impact**: the DMA map covers the whole
4096-byte cluster (`m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, IWM_RBUF_SIZE)` at
`if_iwm_util.c:227`), so fw reads stay in-bounds regardless of the length
field. Trigger surface: the only variable-size wide commands are scan
requests (`if_iwm_scan.c:605-628`, `714-728`), whose size is
device-NVM-derived (`iwm_scan_size(sc)`) and pre-checked against
`IWM_MAX_CMD_PAYLOAD_SIZE`; reaching exactly `paylen == 4088` requires a
specific NIC configuration, and scan submission is privileged
(`SIOCS80211` → `caps_priv_check_self(SYSCAP_NONET_WIFI)`,
`sys/netproto/802_11/wlan/ieee80211_ioctl.c:3471-3472`).

Severity: **Info** (latent hw-spec violation / hardening). Not kernel-
exploitable, not practically triggerable.

## Build / run

```
cc -o /tmp/tfdlen tfd_len_check.c
/tmp/tfdlen
```

## Expected output

See `run.log` — decisive lines:

```
  paylen     totlen  enc.len(bits)     dec.length verdict
    4084       4092          65472           4092  ok
    4085       4093          65488           4093  EXCEEDS HW TB CAP (4K-4)
    ...
    4088       4096              0              0  EXCEEDS HW TB CAP (4K-4)
```

The demo compiles the *exact* constants and structure layouts from
`if_iwmreg.h` and evaluates the *exact* expression from `if_iwm_util.c:282`.
It was compiled and executed on the audit QEMU guest (DragonFly 6.5-DEVELOPMENT).
The in-kernel/fw manifestation was NOT exercised: the guest has no Intel
Wireless hardware (`/dev/iwm*` absent, no wifi PCI devices) — see VERDICT.md.