Summary

oce_sysctl.c:257 oce_be3_fwupgrade casts fw->data to flash_file_hdr* and reads fhdr->build[0] WITHOUT checking datasize >= sizeof(flash_file_hdr)=128. 263 device_printf(%s, &fhdr->build[2]) build[24] need not NUL-terminate -> printf walks past build[23] through rsvd[32]. 265 num_imgs from firmware header no upper bound; loop 266-273 computes img_ptr=fw->data+sizeof(flash_file_hdr)+i*48 derefs img_ptr->imageid with NO bounds vs datasize. oce_be3_flashdata: 297 cookie loop checks p<fw->data+datasize before memcmp(cookie, fsec->cookie, 32) -> reads up to 31B past datasize on final partial. 322 fsec_entry[i] type 60B struct array of 32 = 1920B can lie outside datasize. oce_lancer_fwupgrade 515 size -= data_written NO check data_written <= chunk_size/size -> underflow -> 32KB OOB bcopy. Root-only via hw.oceN.fw_upgrade sysctl + firmware_register. Fix: validate datasize at each structure, bound num_imgs, check data_written <= chunk_size.