Summary

iwm_phy_db_set_section L264-328 parses firmware IWM_CALIB_RES_NOTIF_PHY_DB notification (pkt->data <=4KB mbuf cluster IWM_RBUF_SIZE=4096) but NEVER calls iwm_rx_packet_payload_len(pkt) (helper exists if_iwmreg.h:6943-6948 used defensively elsewhere if_iwm.c:2778/5535). L271 size=le16toh(phy_db_notif->length) consumed as memcpy length L319 memcpy(entry->data,phy_db_notif->data,size) with size up to 65535 but source has at most payload_len-4 valid bytes (~4092). Firmware claiming length=65535 with short payload makes memcpy walk ~61KB past 4KB mbuf cluster -> reliably crosses unmapped page -> kernel panic. type/length reads L270-271 need payload_len>=4; chg_id reads L279/293 *(uint16_t*)phy_db_notif->data need payload_len>=6; none checked. channel_id_to_txp L389 casts entry->data to iwm_phy_db_chg_txp* reads max_channel_idx offset 4 without checking entry->size>=6. Attacker is WiFi firmware (hardware trust boundary). Trigger: ifconfig iwm0 up INIT-ucode calibration. No remote/network path. Buggy/hostile firmware notification. Fix: validate size<=paylen-sizeof(notif) before memcpy; check entry->size>=sizeof(iwm_phy_db_chg_txp) in channel_id_to_txp.