# DF-4833 — VERDICT

**Status: untested** (unit-level arithmetic reproduced; kernel/fw
manifestation not exercisable — no iwm hardware in the audit guest)
**Impact: none** (no kernel memory-safety impact; fw-side length confusion)
**Confidence: certain** (the truncation is proven arithmetic on the exact
code constants; see run.log)

## What was verified

1. **The defect is real at the code level.** `tfd_len_check.c` reproduces the
   exact expression of `sys/dev/netif/iwm/if_iwm_util.c:282-283` with the
   exact constants of `sys/dev/netif/iwm/if_iwmreg.h`:

   * `IWM_MAX_CMD_PAYLOAD_SIZE == 4088` (`if_iwmreg.h:6881`);
   * wide header = 8 bytes (`if_iwmreg.h:6866-6874`, selected at
     `if_iwm_util.c:206-207` when `iwm_cmd_groupid(code) != 0`);
   * `hi_n_len` carries the TB length in bits 4-15 — 12 bits, max 4095
     (`if_iwmreg.h:1846-1858`);
   * hw caps one transmit buffer at (4K-4) = 4092 (`if_iwmreg.h:1882-1883`).

   Result (guest-compiled, `run.log`): `hdrlen=8, paylen=4088` → totlen 4096
   → encoded TB0 length **0**. `paylen` 4085-4087 encode 4093-4095 — over
   the hw cap.

2. **Why no kernel memory corruption.** The mbuf path maps the full 4096-byte
   jcluster (`m_getjcl(..., IWM_RBUF_SIZE)` at `if_iwm_util.c:227`,
   `IWM_RBUF_SIZE == 4096` at `if_iwmvar.h:290`), so whatever length the
   firmware believes, its DMA fetch of the command buffer stays inside the
   mapped cluster. The defect corrupts only the *firmware's view* of the
   command length.

3. **Why the manifestation is not testable here.** The audit guest
   (DragonFly 6.5-DEVELOPMENT x86_64, `env.txt`) has no Intel Wireless
   device — no `/dev/iwm*`, no wifi PCI function. `iwm_send_cmd()` runs only
   against real iwm firmware. Hence verdict `untested` (the manifest's
   permitted vocabulary has no `not_testable` for poc status), impact `none`.

4. **Reachability honesty.** The only `iwm_send_cmd()` callers whose paylen
   approaches the boundary are the scan request builders
   (`sys/dev/netif/iwm/if_iwm_scan.c:605-628` and `714-728`): they size the
   command from `iwm_scan_size(sc)` — device/NVM-derived, not per-request
   user-tunable — and pre-reject `req_len > IWM_MAX_CMD_PAYLOAD_SIZE`.
   Hitting exactly `paylen == 4088` requires a NIC whose supported-channel
   count makes the fixed request size land there. Scan submission is
   privileged (`ieee80211_ioctl.c:3471-3472`). Even when hit, the outcome is
   fw-side (dropped command / fw error / radio reset), bounded by the
   driver's restart machinery. This is why the finding is filed **Info**.

## Exploit chain

None. No kernel memory-safety consequence; fw-side confusion only.

## Fix validation

Not performed on hardware (`fix_status: not_testable`). The proposed
`fix.diff` (reject `totlen > IWM_MAX_CMD_PAYLOAD_SIZE + sizeof(cmd->hdr)`,
i.e. 4092, covering both header widths) was authored against the read-only
`sys/` tree after line-accurate confirmation of the root cause; it was not
applied to `sys/`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.